Trojan.DownLoader38.39504

Technical Information

To ensure autorun and distribution

Substitutes the following executable system files

%WINDIR%\SysWOW64\api-ms-win-core-console-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-console-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-synch-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-string-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-string-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-rtlsupport-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-profile-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll with %TEMP%\rme\x64\system64\api-ms-win-core-processthreads-l1-1-1.dll
<SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-processthreads-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-processenvironment-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-namedpipe-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-memory-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-libraryloader-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-sysinfo-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-interlocked-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-heap-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-handle-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-file-l2-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-file-l2-1-0.dll
<SYSTEM32>\api-ms-win-core-file-l1-2-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-file-l1-2-0.dll
<SYSTEM32>\api-ms-win-core-file-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-file-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-errorhandling-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-debug-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-localization-l1-2-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-process-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-process-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-timezone-l1-1-0.dll
<SYSTEM32>\vccorlib140.dll with %TEMP%\rme\x64\system64\vccorlib140.dll
<SYSTEM32>\vcamp140.dll with %TEMP%\rme\x64\system64\vcamp140.dll
<SYSTEM32>\ucrtbase.dll with %TEMP%\rme\x64\system64\ucrtbase.dll
<SYSTEM32>\msvcp140.dll with %TEMP%\rme\x64\system64\msvcp140.dll
<SYSTEM32>\concrt140.dll with %TEMP%\rme\x64\system64\concrt140.dll
<SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-utility-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-time-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-string-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-stdio-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-datetime-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-synch-l1-2-0.dll
<SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-private-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-multibyte-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-math-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-locale-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-heap-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-filesystem-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-environment-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-convert-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-conio-l1-1-0.dll
<SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-process-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-util-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-util-l1-1-0.dll
<SYSTEM32>\api-ms-win-core-console-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-core-console-l1-1-0.dll
%WINDIR%\SysWOW64\vcruntime140.dll with %TEMP%\rme\x86\system\vcruntime140.dll
%WINDIR%\SysWOW64\vcomp140.dll with %TEMP%\rme\x86\system\vcomp140.dll
%WINDIR%\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-libraryloader-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-string-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-string-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-rtlsupport-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-profile-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-profile-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll with %TEMP%\rme\x86\system\api-ms-win-core-processthreads-l1-1-1.dll
%WINDIR%\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-processthreads-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-processenvironment-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-namedpipe-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-memory-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-memory-l1-1-0.dll
<SYSTEM32>\vcomp140.dll with %TEMP%\rme\x64\system64\vcomp140.dll
%WINDIR%\SysWOW64\api-ms-win-core-synch-l1-2-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-synch-l1-2-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-interlocked-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-heap-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-heap-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-handle-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-handle-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-file-l2-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-file-l2-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-file-l1-2-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-file-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-file-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-errorhandling-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-debug-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-debug-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-datetime-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-localization-l1-2-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-localization-l1-2-0.dll
<SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll with %TEMP%\rme\x64\system64\api-ms-win-crt-runtime-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-sysinfo-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-conio-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-timezone-l1-1-0.dll
%WINDIR%\SysWOW64\vccorlib140.dll with %TEMP%\rme\x86\system\vccorlib140.dll
%WINDIR%\SysWOW64\vcamp140.dll with %TEMP%\rme\x86\system\vcamp140.dll
%WINDIR%\SysWOW64\ucrtbase.dll with %TEMP%\rme\x86\system\ucrtbase.dll
%WINDIR%\SysWOW64\msvcp140.dll with %TEMP%\rme\x86\system\msvcp140.dll
%WINDIR%\SysWOW64\concrt140.dll with %TEMP%\rme\x86\system\concrt140.dll
%WINDIR%\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-utility-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-time-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-time-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-string-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-string-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-util-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-util-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-stdio-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-core-synch-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-core-synch-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-private-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-private-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-multibyte-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-math-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-math-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-locale-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-heap-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-filesystem-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-environment-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-convert-l1-1-0.dll
%WINDIR%\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll with %TEMP%\rme\x86\system\api-ms-win-crt-runtime-l1-1-0.dll
<SYSTEM32>\vcruntime140.dll with %TEMP%\rme\x64\system64\vcruntime140.dll

Modifies file system

Creates the following files

%TEMP%\rme\madifaceusb.exe
%TEMP%\rme\x64\system64\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-file-l2-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-file-l1-2-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-file-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\rme\x64\system64\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-console-l1-1-0.dll
%TEMP%\msi774f1.log
%TEMP%\rme\x86\system\vcruntime140.dll
%TEMP%\rme\x86\system\vcomp140.dll
%TEMP%\rme\x86\system\vccorlib140.dll
%TEMP%\rme\x86\system\vcamp140.dll
%TEMP%\rme\x86\system\ucrtbase.dll
%TEMP%\rme\x86\system\msvcp140.dll
%TEMP%\rme\x86\system\concrt140.dll
%TEMP%\rme\x86\system\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\rme\x64\system64\vcruntime140.dll
%TEMP%\rme\x64\system64\api-ms-win-core-string-l1-1-0.dll
%TEMP%\rme\x64\system64\vcomp140.dll
%TEMP%\rme\x64\system64\vccorlib140.dll
%TEMP%\rme\x64\system64\vcamp140.dll
%TEMP%\rme\x64\system64\ucrtbase.dll
%TEMP%\rme\x64\system64\msvcp140.dll
%TEMP%\rme\x64\system64\concrt140.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-util-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-file-l2-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-console-l1-1-0.dll
%BOOT_VOL%\boot\bcd
%BOOT_VOL%\boot\bcd.log
%TEMP%\msi774f0.log
%TEMP%\rme\dpinst.xml
%TEMP%\rme\vc_runtimeminimum_x86.msi
%TEMP%\rme\vc_runtimeminimum_x64.msi
%TEMP%\rme\rme.bmp
%TEMP%\rme\eula_en.txt
%TEMP%\rme\x86\system\api-ms-win-core-file-l1-1-0.dll
%TEMP%\rme\eula_de.txt
%TEMP%\rme\dpinst.exe
%TEMP%\rme\cabx64.cab
%TEMP%\rme\cab1.cab
%TEMP%\rme\totalmixfx.exe
%TEMP%\rme\totalmixfx.chm
%TEMP%\rme\madiface_usb_old.cat
%TEMP%\rme\madiface_usb_asio_64.dll
%TEMP%\rme\madiface_usb_asio.dll
%TEMP%\rme\madiface_usb_64.sys
%TEMP%\rme\madiface_usb.sys
%TEMP%\rme\madiface_usb.inf
%TEMP%\rme\madiface_usb.cat
%TEMP%\rme\dpinst64.exe
%TEMP%\rme\x86\system\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-util-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-string-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\rme\x86\system\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-file-l1-2-0.dll
%WINDIR%\dpinst.log

Deletes the following files

%TEMP%\rme\x86\system\api-ms-win-core-console-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-string-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\rme\x64\system64\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-file-l2-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-file-l1-2-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-file-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\rme\x64\system64\vcomp140.dll
%TEMP%\rme\x64\system64\vccorlib140.dll
%TEMP%\rme\x64\system64\vcamp140.dll
%TEMP%\rme\x64\system64\ucrtbase.dll
%TEMP%\rme\x64\system64\msvcp140.dll
%TEMP%\rme\x64\system64\concrt140.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-util-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\rme\x64\system64\api-ms-win-core-console-l1-1-0.dll
%TEMP%\rme\cab1.cab
%TEMP%\rme\x86\system\vcruntime140.dll
%TEMP%\rme\x86\system\api-ms-win-core-string-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\rme\x86\system\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-file-l2-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-file-l1-2-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-file-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\rme\x86\system\vcomp140.dll
%TEMP%\rme\x86\system\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\rme\x86\system\vccorlib140.dll
%TEMP%\rme\x86\system\vcamp140.dll
%TEMP%\rme\x86\system\ucrtbase.dll
%TEMP%\rme\x86\system\msvcp140.dll
%TEMP%\rme\x86\system\concrt140.dll
%TEMP%\rme\x86\system\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-core-util-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\rme\x86\system\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\rme\x64\system64\vcruntime140.dll
%TEMP%\rme\madiface_usb.cat

Modifies the following files

%LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
%LOCALAPPDATA%\microsoft\windows\usrclass.dat

Substitutes the following files

%TEMP%\rme\cab1.cab
%TEMP%\rme\madiface_usb.cat

Network activity

Connects to

'microsoft.com':80

UDP

DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%TEMP%\rme\dpinst64.exe'
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-1.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-1.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-1.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-profile-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processenvironment-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-processenvironment-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-namedpipe-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-namedpipe-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-namedpipe-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-memory-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processenvironment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-profile-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-sysinfo-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-sysinfo-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-sysinfo-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-2-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-synch-l1-2-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-memory-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-profile-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-synch-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-string-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-string-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-rtlsupport-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-rtlsupport-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-rtlsupport-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-memory-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-localization-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-localization-l1-2-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-debug-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-console-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-datetime-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-datetime-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-datetime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-debug-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-timezone-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-debug-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-2-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-errorhandling-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-errorhandling-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-file-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-errorhandling-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l2-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-file-l2-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-localization-l1-2-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-libraryloader-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-libraryloader-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-libraryloader-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-interlocked-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l2-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-interlocked-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-file-l1-2-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-heap-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-heap-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-handle-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-handle-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-handle-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-interlocked-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-multibyte-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcruntime140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-util-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\concrt140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\concrt140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-utility-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-utility-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-utility-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\msvcp140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-time-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-time-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-string-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-string-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-stdio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-stdio-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-time-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-timezone-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\msvcp140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcruntime140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vcruntime140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcomp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcomp140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vcomp140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vccorlib140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-stdio-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\concrt140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcamp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcamp140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vcamp140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\ucrtbase.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\ucrtbase.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\ucrtbase.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vccorlib140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\msvcp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-runtime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-runtime-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-runtime-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-convert-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-util-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-util-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-conio-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-conio-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-conio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-timezone-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-convert-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-heap-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-environment-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-environment-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-environment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-filesystem-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-filesystem-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-convert-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-console-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-heap-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-locale-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-process-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-process-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-process-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-private-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-private-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-locale-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-private-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-filesystem-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-multibyte-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-math-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-math-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-math-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-locale-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-multibyte-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vccorlib140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-console-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vccorlib140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcruntime140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\concrt140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\concrt140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\msvcp140.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vcruntime140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcomp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcomp140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vcomp140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vccorlib140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vccorlib140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\concrt140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcamp140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vcamp140.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\ucrtbase.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\ucrtbase.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\ucrtbase.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\msvcp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcamp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\msvcp140.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcruntime140.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll /grant Users:(GR,GE)' (with hidden window)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll' (with hidden window)

Executes the following

'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-1.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-1.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-profile-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processenvironment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-processenvironment-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-namedpipe-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-namedpipe-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-namedpipe-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-memory-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-memory-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processenvironment-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-timezone-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-profile-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-sysinfo-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-sysinfo-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-2-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-synch-l1-2-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-memory-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-processthreads-l1-1-1.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-string-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-string-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-rtlsupport-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-rtlsupport-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-rtlsupport-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-synch-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-profile-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-synch-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-sysinfo-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-localization-l1-2-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-datetime-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-datetime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-debug-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-debug-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-debug-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-errorhandling-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-errorhandling-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-errorhandling-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-file-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-file-l1-2-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-2-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-file-l2-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-libraryloader-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-heap-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-libraryloader-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-libraryloader-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-interlocked-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-interlocked-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-interlocked-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-localization-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-localization-l1-2-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-console-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-handle-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-handle-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-handle-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l2-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-file-l2-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-heap-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-timezone-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-stdio-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\concrt140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\concrt140.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-utility-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-utility-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-utility-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\msvcp140.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-time-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-time-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-string-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-string-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-stdio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-stdio-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-time-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-timezone-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\msvcp140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcomp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcomp140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vcomp140.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vccorlib140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vccorlib140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-runtime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vccorlib140.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\concrt140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vcamp140.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\ucrtbase.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\ucrtbase.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\ucrtbase.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\msvcp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcamp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-runtime-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\vcruntime140.dll
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-runtime-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-process-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-filesystem-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-console-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-convert-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-util-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-util-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-core-util-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-conio-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-heap-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-conio-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-convert-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-filesystem-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-convert-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-environment-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-environment-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-environment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-conio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-datetime-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-multibyte-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-multibyte-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-process-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-private-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-private-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-private-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-multibyte-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-process-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-heap-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-filesystem-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-math-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-math-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-locale-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-locale-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-crt-locale-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\api-ms-win-crt-math-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\Sysnative\api-ms-win-core-console-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcruntime140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcruntime140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-namedpipe-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processenvironment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-processthreads-l1-1-1.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-profile-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-synch-l1-2-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-synch-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-rtlsupport-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-localization-l1-2-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-console-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-datetime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-sysinfo-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-errorhandling-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-debug-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcruntime140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-2-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-libraryloader-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-interlocked-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-handle-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-file-l2-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcamp140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-utility-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\concrt140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-string-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-stdio-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-time-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-memory-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\msvcp140.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vcruntime140.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcamp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vccorlib140.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcomp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcomp140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vcomp140.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vccorlib140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vccorlib140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\concrt140.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\msvcp140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\vcamp140.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\ucrtbase.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\ucrtbase.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\ucrtbase.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\msvcp140.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\vcamp140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\concrt140.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-runtime-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-util-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-convert-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-environment-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-conio-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-core-timezone-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-heap-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-process-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-private-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-filesystem-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll /grant Users:(GR,GE)
'%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\api-ms-win-crt-math-l1-1-0.dll
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-locale-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\api-ms-win-crt-multibyte-l1-1-0.dll /grant "NT SERVICE\TrustedInstaller:(F)"
'%WINDIR%\syswow64\icacls.exe' %WINDIR%\Sysnative\vcruntime140.dll /grant "NT SERVICE\TrustedInstaller:(F)"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней