0ade46c70e72d18fa408e8b0a79791363f5fb52f34a0924829f936bf1d3e9085

Analysis

max time kernel
0s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
Size

6.5MB
MD5

1a699d18fc42426c1fdfe7ad01a42d20
SHA1

f8b0d7c0019f48ffb8f6d0f0634104751cc5842f
SHA256

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270
SHA512

b6c0abad59318341f2ce0c9057df1d3dfe6421da36519b15927bbe769807ca007761bc47a64e69513ddb9d9cd02f8f2df6bce755a5c26adfadacd62da08ba253
SSDEEP

196608:ugY5Wpp0209r4M3jtxMTdLZ4jSonnP6TH3DwGP:Y5Wp0202A/ConuP

Score

9^/10

discovery evasion ransomware upx

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

pid process

8948
8596

pid	process
8948
8596

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

pid	process
5868	takeown.exe
8900	takeown.exe
7460	takeown.exe
5576	takeown.exe
6160	takeown.exe
6864
3956	takeown.exe
9024
7012
5696	takeown.exe
4376	takeown.exe
7768	takeown.exe
6272	takeown.exe
2800	takeown.exe
8048	takeown.exe
7816	takeown.exe
7944	takeown.exe
4836	takeown.exe
5840
5620	takeown.exe
5996	takeown.exe
8372	takeown.exe
8628	takeown.exe
7092
5900	takeown.exe
5008	takeown.exe
276	takeown.exe
5796
4916
7548	takeown.exe
7228	takeown.exe
7100	takeown.exe
5320	takeown.exe
8348	takeown.exe
4812	takeown.exe
4132	takeown.exe
6424	takeown.exe
8140
5680	takeown.exe
8104	takeown.exe
8596	takeown.exe
6016
7852
7388	takeown.exe
3108	takeown.exe
8352	takeown.exe
836	takeown.exe
6940	takeown.exe
6904
5364
5868	takeown.exe
920	takeown.exe
5484	takeown.exe
7784	takeown.exe
7520
8456	takeown.exe
1708	takeown.exe
6960	takeown.exe
8980
2052	takeown.exe
3672	takeown.exe
8808
4188
8476	takeown.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/6692-9481-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6856-9497-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7376-9499-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/5824-9649-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6088-9928-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/8608-10916-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/8608-11067-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6084-11859-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/4932-12646-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/9204-12653-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7912-12815-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6716-12817-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/8184-12822-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/8028-12820-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6500-12818-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6036-12807-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/8064-12803-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7572-12801-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6896-12799-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7672-12797-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6716-12795-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7976-12655-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7848-12651-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/7848-12650-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/8776-12648-0x0000000000400000-0x0000000000477000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe	upx
behavioral2/memory/4932-12645-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6692-12644-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/4188-12642-0x0000000000400000-0x0000000000477000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe	upx
behavioral2/memory/180-9493-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/6756-9490-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

pid process

464 095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

8156 schtasks.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

pid process

5548

pid	process
464	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

pid	process
8156	schtasks.exe

pid	process
5548

C:\Users\Admin\AppData\Local\Temp\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
"C:\Users\Admin\AppData\Local\Temp\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe" "C:\Users\Admin\AppData\Local\Temp\NWBlruYk.exe"
  2⤵
  PID:3300
- C:\Users\Admin\AppData\Local\Temp\NWBlruYk.exe
  "C:\Users\Admin\AppData\Local\Temp\NWBlruYk.exe" -n
  2⤵
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\pxsQTSj4.vbs"
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\pxsQTSj4.vbs"
    3⤵
    PID:4984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\0WytFXFa.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      PID:7848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\0WytFXFa.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Creates scheduled task(s)
        
        PID:8156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      PID:7556
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:9140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006N.bin" -nobanner
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        5⤵
        
        PID:8176
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"
        5⤵
        
        PID:4984
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C
        5⤵
        
        PID:308
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin"
      4⤵
      PID:9016
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin" /E /G Admin:F /C
      4⤵
      PID:6464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\VlwGMOLz.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\VlwGMOLz.bmp" /f
    3⤵
    PID:7540
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    PID:8224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    PID:7072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AD.bin" -nobanner
    3⤵
    PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "000000AD.bin" -nobanner
      4⤵
      PID:2020
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8372
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin"
    3⤵
    PID:6908
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin" /E /G Admin:F /C
    3⤵
    PID:6304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""
  2⤵
  PID:6636
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:6412
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"
    3⤵
    - Modifies file permissions
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db""
  2⤵
  PID:8164
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db" /E /G Admin:F /C
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.62e2a315-93ea-46c9-a982-6ae4b9dd3d06.1.etl"
    3⤵
    - Modifies file permissions
    PID:8372
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.62e2a315-93ea-46c9-a982-6ae4b9dd3d06.1.etl" -nobanner
    3⤵
    PID:8776
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.62e2a315-93ea-46c9-a982-6ae4b9dd3d06.1.etl" /E /G Admin:F /C
    3⤵
    PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        5⤵
        
        PID:5796
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000H.bin" -nobanner
        5⤵
        
        PID:5480
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"
        5⤵
        
        PID:6964
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C
        5⤵
        
        PID:7452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        5⤵
        
        PID:8276
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000054.bin" -nobanner
        5⤵
        
        PID:5396
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C
        5⤵
        
        PID:7376
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"
      4⤵
      PID:8528
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C
      4⤵
      PID:8276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
  2⤵
  PID:7032
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6084
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"
      4⤵
      Modifies file permissions
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:8680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000095.bin" -nobanner
      4⤵
      PID:8812
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C
      4⤵
      PID:5224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""
  2⤵
  PID:7256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
  2⤵
  PID:8944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""
  2⤵
  PID:8696
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"
    3⤵
    PID:5644
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "00000081.bin" -nobanner
      4⤵
      PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:7232
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:8464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"
      4⤵
      PID:8252
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C
      4⤵
      PID:7232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""
  2⤵
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm""
  2⤵
  PID:5852
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "0000008J.bin" -nobanner
      4⤵
      PID:8520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""
  2⤵
  PID:5512
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C
    3⤵
    PID:6820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000017.bin" -nobanner
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "00000005.bin" -nobanner
        5⤵
        
        PID:7484
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "superbar.png" -nobanner
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
        5⤵
        
        PID:6080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""
  2⤵
  PID:8948
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    - Modifies file permissions
    PID:8352
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:5616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008J.bin" -nobanner
      4⤵
      PID:6716
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"
      4⤵
      PID:4400
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C
      4⤵
      PID:6484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
  2⤵
  PID:5540
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"
    3⤵
    PID:6432
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""
  2⤵
  PID:8392
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C
    3⤵
    PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "0000000T.bin" -nobanner
      4⤵
      PID:8880
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5244
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin"
      4⤵
      PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:8284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000085.bin" -nobanner
      4⤵
      PID:8456
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin" /E /G Admin:F /C
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "0000007V.bin" -nobanner
        5⤵
        
        PID:5600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008D.bin" -nobanner
    3⤵
    PID:7460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"
    3⤵
    PID:6752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi""
  2⤵
  PID:8612
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi" /E /G Admin:F /C
    3⤵
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"
    3⤵
    PID:8728
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000012.bin" -nobanner
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C
    3⤵
    PID:5256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""
  2⤵
  PID:5628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007A.bin" -nobanner
    3⤵
    PID:8308
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "0000006N.bin" -nobanner
    3⤵
    PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000F.bin" -nobanner
      4⤵
      PID:8700
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin"
      4⤵
      PID:6472
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin" /E /G Admin:F /C
      4⤵
      PID:7960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""
  2⤵
  PID:8980
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"
    3⤵
    PID:6992
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin""
  2⤵
  PID:9208
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin" /E /G Admin:F /C
    3⤵
    PID:6912
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:8868
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"
      4⤵
      PID:3320
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C
      4⤵
      PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000N.bin" -nobanner
    3⤵
    PID:7508
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin"
    3⤵
    PID:6936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
  2⤵
  PID:7020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
    3⤵
    PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:5184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000R.bin" -nobanner
      4⤵
      PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        5⤵
        
        PID:8372
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "0000006S.bin" -nobanner
        6⤵
        
        PID:8712
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat"
        5⤵
        
        PID:6332
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
        5⤵
        
        PID:6964
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin"
      4⤵
      PID:5680
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin" /E /G Admin:F /C
      4⤵
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl""
  2⤵
  PID:6844
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl" -nobanner
    3⤵
    PID:6276
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl"
    3⤵
    PID:6368
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl" /E /G Admin:F /C
    3⤵
    PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl""
  2⤵
  PID:6532
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl"
    3⤵
    PID:8136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""
  2⤵
  PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:8168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin""
  2⤵
  PID:7576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009J.bin" -nobanner
    3⤵
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "0000009J.bin" -nobanner
      4⤵
      PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
        5⤵
        
        PID:6700
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "00000011.bin" -nobanner
    3⤵
    PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:6356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "watermark.png" -nobanner
      4⤵
      PID:3396
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009L.bin" -nobanner
        5⤵
        
        PID:8744
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin" /E /G Admin:F /C
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "0000000S.bin" -nobanner
        6⤵
        
        PID:5720
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"
      4⤵
      Modifies file permissions
      PID:5900
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C
      4⤵
      PID:7344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin""
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin" /E /G Admin:F /C
    3⤵
    PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:8864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "background.png" -nobanner
      4⤵
      PID:7080
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"
      4⤵
      Modifies file permissions
      PID:7460
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C
      4⤵
      PID:5824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin""
  2⤵
  PID:7092
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin" /E /G Admin:F /C
    3⤵
    PID:8624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007R.bin" -nobanner
      4⤵
      PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "00000010.bin" -nobanner
        5⤵
        
        PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:7560
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin"
      4⤵
      PID:8016
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin" /E /G Admin:F /C
      4⤵
      PID:6836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin""
  2⤵
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AH.bin" -nobanner
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin"
    3⤵
    - Modifies file permissions
    PID:6424
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin" /E /G Admin:F /C
    3⤵
    PID:8660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin""
  2⤵
  PID:8792
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin"
    3⤵
    - Modifies file permissions
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:6972
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin"
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin" /E /G Admin:F /C
      4⤵
      PID:6468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000B3.bin" -nobanner
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin" /E /G Admin:F /C
    3⤵
    PID:8988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin""
  2⤵
  PID:7064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009F.bin" -nobanner
    3⤵
    PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "0000009F.bin" -nobanner
      4⤵
      PID:284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin""
  2⤵
  PID:8496
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000A6.bin" -nobanner
    3⤵
    PID:7360
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin"
    3⤵
    PID:8092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin""
  2⤵
  PID:5840
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000089.bin" -nobanner
    3⤵
    PID:7164
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin"
    3⤵
    PID:7232
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin" /E /G Admin:F /C
    3⤵
    PID:6684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin""
  2⤵
  PID:7520
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin"
    3⤵
    PID:7848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "device.png" -nobanner
      4⤵
      PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "device.png" -nobanner
        5⤵
        
        PID:6000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000B7.bin" -nobanner
        5⤵
        
        PID:7192
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin" /E /G Admin:F /C
        5⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        6⤵
        
        PID:6480
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006S.bin" -nobanner
        6⤵
        
        PID:6376
      - C:\Windows\SysWOW64\takeown.exe
        
        takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"
        6⤵
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        5⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "0000008F.bin" -nobanner
        6⤵
        
        PID:3136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000L.bin" -nobanner
        5⤵
        
        PID:9136
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin"
        5⤵
        
        PID:7192
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin" /E /G Admin:F /C
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:4916
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"
      4⤵
      Modifies file permissions
      PID:920
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C
      4⤵
      PID:304
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin""
  2⤵
  PID:7004
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin" /E /G Admin:F /C
    3⤵
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:7700
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"
      4⤵
      PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
        5⤵
        
        PID:5508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000V.bin" -nobanner
        5⤵
        
        PID:8280
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin"
        5⤵
        Modifies file permissions
        
        PID:5320
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin" /E /G Admin:F /C
        5⤵
        
        PID:8272
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C
      4⤵
      PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl" -nobanner
        5⤵
        
        PID:4184
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000093.bin" -nobanner
    3⤵
    PID:7556
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin"
    3⤵
    - Modifies file permissions
    PID:5576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000081.bin" -nobanner
      4⤵
      PID:7700
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin" /E /G Admin:F /C
      4⤵
      PID:5364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl""
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl"
    3⤵
    - Modifies file permissions
    PID:7816
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl" -nobanner
    3⤵
    PID:5452
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl" /E /G Admin:F /C
    3⤵
    PID:8604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl""
  2⤵
  PID:8812
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "00000095.bin" -nobanner
    3⤵
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl""
  2⤵
  PID:7560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl""
  2⤵
  PID:7684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""
  2⤵
  PID:8344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""
  2⤵
  PID:7848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""
  2⤵
  PID:8396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin""
  2⤵
  PID:6480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.62e2a315-93ea-46c9-a982-6ae4b9dd3d06.1.etl""
  2⤵
  PID:8164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""
  2⤵
  PID:7768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""
  2⤵
  PID:7492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl""
  2⤵
  PID:7720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""
  2⤵
  PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""
  2⤵
  PID:7724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin""
  2⤵
  PID:6468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin""
  2⤵
  PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin""
  2⤵
  PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin""
  2⤵
  PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin""
  2⤵
  PID:8196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin""
  2⤵
  PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""
  2⤵
  PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin""
  2⤵
  PID:5912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin""
  2⤵
  PID:7152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin""
  2⤵
  PID:5984
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:8452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin""
  2⤵
  PID:8996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""
  2⤵
  PID:5548
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "0000008L.bin" -nobanner
    3⤵
    PID:8308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin""
  2⤵
  PID:7496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin""
  2⤵
  PID:6476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin""
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin""
  2⤵
  PID:6344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin""
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin""
  2⤵
  PID:7596
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6660
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"
    3⤵
    - Modifies file permissions
    PID:3108
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C
    3⤵
    PID:6388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin""
  2⤵
  PID:8240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin""
  2⤵
  PID:5576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin""
  2⤵
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin""
  2⤵
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin""
  2⤵
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin""
  2⤵
  PID:6068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin""
  2⤵
  PID:9032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin""
  2⤵
  PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin""
  2⤵
  PID:8624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin""
  2⤵
  PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin""
  2⤵
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.08cce21c-43a0-40eb-99e4-681f9cf37841.1.etl""
  2⤵
  PID:8160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.1.etl""
  2⤵
  PID:9168
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "00000052.bin" -nobanner
    3⤵
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin""
  2⤵
  PID:6108
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "00000012.bin" -nobanner
    3⤵
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin""
  2⤵
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin""
  2⤵
  PID:7376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin""
  2⤵
  PID:180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin""
  2⤵
  PID:5440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin""
  2⤵
  PID:7336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin""
  2⤵
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin""
  2⤵
  PID:5312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin""
  2⤵
  PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin""
  2⤵
  PID:6052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin""
  2⤵
  PID:5968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl""
  2⤵
  PID:7112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin""
  2⤵
  PID:5244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin""
  2⤵
  PID:8768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin""
  2⤵
  PID:6812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin""
  2⤵
  PID:8308
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "0000007A.bin" -nobanner
    3⤵
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin""
  2⤵
  PID:7748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin""
  2⤵
  PID:7520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin""
  2⤵
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:8128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin""
  2⤵
  PID:6384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin""
  2⤵
  PID:8704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin""
  2⤵
  PID:5212
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl" -nobanner
    3⤵
    PID:7144
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl"
    3⤵
    PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "00000008.bin" -nobanner
      4⤵
      PID:7988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl""
  2⤵
  PID:8052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
  2⤵
  PID:6196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl""
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin""
  2⤵
  PID:8972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin""
  2⤵
  PID:6372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""
  2⤵
  PID:9120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""
  2⤵
  PID:5500
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "wab.exe" -nobanner
    3⤵
    PID:6536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""
  2⤵
  PID:7952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin""
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin""
  2⤵
  PID:1808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""
  2⤵
  PID:7464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""
  2⤵
  PID:6236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl""
  2⤵
  PID:8572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat""
  2⤵
  PID:6004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""
  2⤵
  PID:6788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1""
  2⤵
  PID:8464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin""
  2⤵
  PID:6820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin""
  2⤵
  PID:8868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin""
  2⤵
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:8876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""
  2⤵
  PID:8856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""
  2⤵
  PID:9160
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000A9.bin" -nobanner
    3⤵
    PID:7948
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin"
    3⤵
    PID:7932
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin" /E /G Admin:F /C
    3⤵
    PID:5228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""
  2⤵
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "000000A0.bin" -nobanner
    3⤵
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""
  2⤵
  PID:8760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""
  2⤵
  PID:5632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""
  2⤵
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""
  2⤵
  PID:6332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""
  2⤵
  PID:7276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:5356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""
  2⤵
  PID:6112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl""
  2⤵
  PID:5212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag""
  2⤵
  PID:5752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl""
  2⤵
  PID:9080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe""
  2⤵
  PID:7876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab""
  2⤵
  PID:7056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""
  2⤵
  PID:5528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""
  2⤵
  PID:8208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:8024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl""
  2⤵
  PID:5852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl""
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""
  2⤵
  PID:5868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""
  2⤵
  PID:8388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""
  2⤵
  PID:1032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""
  2⤵
  PID:6392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""
  2⤵
  PID:8484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""
  2⤵
  PID:5252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""
  2⤵
  PID:8368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""
  2⤵
  PID:6516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""
  2⤵
  PID:7596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""
  2⤵
  PID:8568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""
  2⤵
  PID:8320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl""
  2⤵
  PID:7096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""
  2⤵
  PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
  2⤵
  PID:6248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""
  2⤵
  PID:6828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""
  2⤵
  PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin""
  2⤵
  PID:9160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin""
  2⤵
  PID:5772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin""
  2⤵
  PID:7864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgV7MEcn.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""
  2⤵
  PID:8632

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\0WytFXFa.bat"
1⤵
PID:7360
- C:\Windows\System32\Wbem\WMIC.exe
  wmic SHADOWCOPY DELETE
  2⤵
  PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000O.bin" -nobanner
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula "0000000O.bin" -nobanner
      4⤵
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8512
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin"
    3⤵
    - Modifies file permissions
    PID:5868
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin" /E /G Admin:F /C
    3⤵
    PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:8964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006D.bin" -nobanner
      4⤵
      PID:1264
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin"
      4⤵
      PID:8604
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin" /E /G Admin:F /C
      4⤵
      PID:8596

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "store.db" -nobanner
1⤵
PID:6692

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"
1⤵
PID:8744
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000009L.bin" -nobanner
  2⤵
  PID:8956

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
1⤵
PID:8236

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6088

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
1⤵
PID:7368

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
1⤵
PID:372

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
1⤵
PID:8608

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:4188
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000007E.bin" -nobanner
  2⤵
  PID:7920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5380

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
1⤵
PID:5608

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
1⤵
PID:8384

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C
1⤵
PID:7916

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"
1⤵
PID:6732

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:9204

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
1⤵
PID:7960

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C
1⤵
PID:7228

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C
1⤵
PID:5528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
  2⤵
  PID:8232
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:8820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
  2⤵
  PID:1480
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"
  2⤵
  PID:9124
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C
  2⤵
  PID:7664

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C
1⤵
PID:7880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "store.db" -nobanner
1⤵
PID:6532

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C
1⤵
PID:5444
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:1480
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
    3⤵
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000B1.bin" -nobanner
  2⤵
  PID:3624
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin"
  2⤵
  PID:5472
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin" /E /G Admin:F /C
  2⤵
  PID:5980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe" -nobanner
1⤵
PID:5544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "BrowserCore.exe.mui" -nobanner
1⤵
PID:3672
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "BrowserCore.exe.mui" -nobanner
  2⤵
  PID:6168

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "classes.jsa" -nobanner
1⤵
PID:5764

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:4812

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"
1⤵
PID:7116

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C
1⤵
PID:2264

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C
1⤵
PID:8524

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C
1⤵
PID:6384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "Identity-V" -nobanner
1⤵
PID:1404

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
1⤵
PID:220

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Windows Mail\wab.exe"
1⤵
- Modifies file permissions
PID:5680

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"
1⤵
PID:5516

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8728

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:7212

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"
1⤵
PID:9016

C:\Windows\SysWOW64\cacls.exe
cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.08cce21c-43a0-40eb-99e4-681f9cf37841.1.etl" /E /G Admin:F /C
1⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7348

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
1⤵
PID:8296

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6896

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C
1⤵
PID:6640

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C
1⤵
PID:6968

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
1⤵
PID:6848

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
1⤵
PID:5532

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8184

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"
1⤵
PID:6980

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6984

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000U.bin" -nobanner
1⤵
PID:7204

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006U.bin" -nobanner
1⤵
PID:5756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000076.bin" -nobanner
1⤵
PID:5176

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5692

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000091.bin" -nobanner
1⤵
PID:8880

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000A0.bin" -nobanner
1⤵
PID:4628
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C
  2⤵
  PID:9044
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007I.bin" -nobanner
  2⤵
  PID:5240
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"
  2⤵
  - Modifies file permissions
  PID:5868
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8016
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C
    3⤵
    PID:5336

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C
1⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8876
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl" -nobanner
  2⤵
  PID:5940

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl" -nobanner
1⤵
PID:5532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
1⤵
PID:6984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000J.bin" -nobanner
1⤵
PID:7204
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000000J.bin" -nobanner
  2⤵
  PID:6004

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000014.bin" -nobanner
1⤵
PID:5436

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"
1⤵
PID:4516

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C
1⤵
PID:7756

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"
1⤵
PID:8728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007C.bin" -nobanner
1⤵
PID:6124

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000007K.bin" -nobanner
1⤵
PID:1132

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000008D.bin" -nobanner
1⤵
PID:7748
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000T.bin" -nobanner
  2⤵
  PID:8356
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin"
  2⤵
  PID:888
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin" /E /G Admin:F /C
  2⤵
  PID:7372

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"
1⤵
PID:8996

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008V.bin" -nobanner
1⤵
PID:7852
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000008V.bin" -nobanner
  2⤵
  PID:8104

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl" -nobanner
1⤵
PID:7348

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl" -nobanner
1⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
1⤵
PID:6460

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab"
1⤵
- Modifies file permissions
PID:7388

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" -nobanner
1⤵
PID:7188

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl" /E /G Admin:F /C
1⤵
PID:9084
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "OfficeIntegrator.ps1" -nobanner
  2⤵
  PID:3848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "KnownGameList.bin" -nobanner
1⤵
PID:6300

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000006.bin" -nobanner
1⤵
PID:7344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000Q.bin" -nobanner
1⤵
PID:4672
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000000Q.bin" -nobanner
  2⤵
  PID:6252

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:1032
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:5608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007K.bin" -nobanner
  2⤵
  PID:8676
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"
  2⤵
  PID:1708
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C
  2⤵
  PID:2984

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000007Q.bin" -nobanner
1⤵
PID:8416
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl" -nobanner
  2⤵
  PID:6272

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000D.bin" -nobanner
1⤵
PID:7984

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000V.bin" -nobanner
1⤵
PID:3672

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "overlay.png" -nobanner
1⤵
PID:6772

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "StorageHealthModel.dat" -nobanner
1⤵
PID:6548

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7440

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "background.png" -nobanner
1⤵
PID:6628

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "ImagingDevices.exe" -nobanner
1⤵
PID:920

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006F.bin" -nobanner
1⤵
PID:9148

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3744

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"
1⤵
- Modifies file permissions
PID:8104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
1⤵
PID:7220
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
  2⤵
  PID:5852
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl" -nobanner
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl"
    3⤵
    PID:6536
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl" /E /G Admin:F /C
    3⤵
    PID:8924

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
1⤵
PID:6604

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:5324

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin"
1⤵
- Modifies file permissions
PID:7548

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000087.bin" -nobanner
1⤵
PID:4580

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl"
1⤵
- Modifies file permissions
PID:5996

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5660

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6556

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin" /E /G Admin:F /C
1⤵
PID:7108

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000009B.bin" -nobanner
1⤵
PID:9072

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
1⤵
PID:8260

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000L.bin" -nobanner
1⤵
PID:8396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
  2⤵
  PID:3148
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
    3⤵
    PID:6732
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:3700
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"
  2⤵
  PID:4920
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C
  2⤵
  PID:5692

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000015.bin" -nobanner
1⤵
PID:8176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000075.bin" -nobanner
1⤵
PID:6644
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000075.bin" -nobanner
  2⤵
  PID:7100

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5224

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin"
1⤵
- Modifies file permissions
PID:8476

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl" -nobanner
1⤵
PID:8256
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl" -nobanner
  2⤵
  PID:8236

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000099.bin" -nobanner
1⤵
PID:6248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
  2⤵
  PID:6968
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
  2⤵
  PID:9204
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
  2⤵
  PID:5340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009H.bin" -nobanner
1⤵
PID:7160
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000009H.bin" -nobanner
  2⤵
  PID:4848

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000G.bin" -nobanner
1⤵
PID:4904

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin"
1⤵
PID:6872

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7564

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000007.bin" -nobanner
1⤵
PID:6516
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000007.bin" -nobanner
  2⤵
  PID:4900

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin" /E /G Admin:F /C
1⤵
PID:7400

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000R.bin" -nobanner
1⤵
PID:7000

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin"
1⤵
PID:8796

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.1.etl" /E /G Admin:F /C
1⤵
PID:1000

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3700

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "WuProvider.08cce21c-43a0-40eb-99e4-681f9cf37841.1.etl" -nobanner
1⤵
PID:5164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "WuProvider.08cce21c-43a0-40eb-99e4-681f9cf37841.1.etl" -nobanner
1⤵
PID:8316

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006J.bin" -nobanner
1⤵
PID:8176

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin"
1⤵
PID:6092

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin" /E /G Admin:F /C
1⤵
PID:6192

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000AN.bin" -nobanner
1⤵
PID:9204

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8820

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000B1.bin" -nobanner
1⤵
PID:6500

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006H.bin" -nobanner
1⤵
PID:7508
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000000N.bin" -nobanner
  2⤵
  PID:6984

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin"
1⤵
- Modifies file permissions
PID:3956

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin"
1⤵
- Modifies file permissions
PID:8048

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5784

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000089.bin" -nobanner
1⤵
PID:8464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008R.bin" -nobanner
1⤵
PID:3000
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000008R.bin" -nobanner
  2⤵
  PID:6948

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8648

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin"
1⤵
PID:5356
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:6516
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000S.bin" -nobanner
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"
    3⤵
    PID:5716
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C
    3⤵
    PID:7440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
  2⤵
  PID:8620
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat"
  2⤵
  PID:5720
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
  2⤵
  PID:5928

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AL.bin" -nobanner
1⤵
PID:6376
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "000000AL.bin" -nobanner
  2⤵
  PID:5184

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin" /E /G Admin:F /C
1⤵
PID:5964

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000AV.bin" -nobanner
1⤵
PID:8764

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe" -nobanner
  2⤵
  PID:2548
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
  2⤵
  PID:8764
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
  2⤵
  PID:4636

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000050.bin" -nobanner
1⤵
PID:7064
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000050.bin" -nobanner
  2⤵
  PID:5036
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:8096
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin"
  2⤵
  - Modifies file permissions
  PID:836
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin" /E /G Admin:F /C
  2⤵
  PID:4412

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin" /E /G Admin:F /C
1⤵
PID:4580

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin"
1⤵
PID:8236

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:9152

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin" /E /G Admin:F /C
1⤵
PID:8532

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8884

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6532
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:5980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl" -nobanner
  2⤵
  PID:8876
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
    3⤵
    PID:7328
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat"
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
    3⤵
    PID:6208
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl" /E /G Admin:F /C
  2⤵
  PID:5468

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin" /E /G Admin:F /C
1⤵
PID:6228

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000008H.bin" -nobanner
1⤵
PID:7304

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"
1⤵
PID:2124
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000G.bin" -nobanner
  2⤵
  PID:7272
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin"
  2⤵
  PID:8052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl" -nobanner
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
      ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
      4⤵
      PID:5840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" -nobanner
      4⤵
      PID:2172
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /F "C:\Users\All Users\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag"
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
        
        ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
        5⤵
        
        PID:9068
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\Users\All Users\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" /E /G Admin:F /C
      4⤵
      PID:756
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl"
    3⤵
    PID:8524
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl" /E /G Admin:F /C
    3⤵
    PID:8252
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin" /E /G Admin:F /C
  2⤵
  PID:6028

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8240
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin"
  2⤵
  PID:6576
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin" /E /G Admin:F /C
  2⤵
  PID:5316

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl" -nobanner
1⤵
PID:5492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl" -nobanner
1⤵
PID:5304
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000009D.bin" -nobanner
  2⤵
  PID:7564

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "watermark.png" -nobanner
1⤵
PID:7576

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
1⤵
PID:7208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
1⤵
PID:7708

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin"
1⤵
PID:6040

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "background.png" -nobanner
1⤵
PID:6172

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl" -nobanner
1⤵
PID:8512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl" -nobanner
1⤵
PID:7636

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8480

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl" -nobanner
1⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl" -nobanner
1⤵
PID:8616
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000018.bin" -nobanner
  2⤵
  PID:7744

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl"
1⤵
- Modifies file permissions
PID:2052

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.3f613709-9590-47d8-84a4-c3524573cbbd.1.etl" /E /G Admin:F /C
1⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl" -nobanner
1⤵
PID:8416

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl"
1⤵
- Modifies file permissions
PID:7228

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl" /E /G Admin:F /C
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000054.bin" -nobanner
  2⤵
  PID:5680

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7092
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006L.bin" -nobanner
  2⤵
  PID:6484
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin"
  2⤵
  PID:7264

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl"
1⤵
PID:5280

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.13cbca30-34b2-4d93-b9a7-c9288549104a.1.etl" /E /G Admin:F /C
1⤵
PID:8668

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl" -nobanner
1⤵
PID:8292

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6124
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000007C.bin" -nobanner
  2⤵
  PID:8244

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
1⤵
PID:540
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
  2⤵
  PID:8640
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
  2⤵
  PID:5964
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
  2⤵
  PID:6040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
1⤵
PID:8560

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin" /E /G Admin:F /C
1⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.62e2a315-93ea-46c9-a982-6ae4b9dd3d06.1.etl" -nobanner
1⤵
PID:8712

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5796

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"
1⤵
PID:7452

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C
1⤵
PID:8368

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6316

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl"
1⤵
PID:6920

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl" /E /G Admin:F /C
1⤵
PID:4488

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
1⤵
PID:8648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
1⤵
PID:5212
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:6776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009B.bin" -nobanner
  2⤵
  PID:5640
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin"
  2⤵
  PID:5316

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C
1⤵
PID:7552

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "superbar.png" -nobanner
1⤵
PID:756

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"
1⤵
PID:8420

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C
1⤵
PID:8464
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "OfficeIntegrator.ps1" -nobanner
  2⤵
  PID:9084
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1"
  2⤵
  PID:5624
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C
  2⤵
  PID:5660

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000093.bin" -nobanner
1⤵
PID:6080

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008H.bin" -nobanner
1⤵
PID:8664

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin"
1⤵
PID:5320
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006P.bin" -nobanner
  2⤵
  PID:6748
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin" /E /G Admin:F /C
  2⤵
  PID:5896

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin" /E /G Admin:F /C
1⤵
PID:8688

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000007O.bin" -nobanner
1⤵
PID:4640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007O.bin" -nobanner
1⤵
PID:8684

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin"
1⤵
- Modifies file permissions
PID:5696

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000007G.bin" -nobanner
1⤵
PID:8828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007G.bin" -nobanner
1⤵
PID:1480

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin"
1⤵
PID:5384

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin" /E /G Admin:F /C
1⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000078.bin" -nobanner
1⤵
PID:6552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000078.bin" -nobanner
1⤵
PID:7056

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin"
1⤵
- Modifies file permissions
PID:4376

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000070.bin" -nobanner
1⤵
PID:6720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000070.bin" -nobanner
1⤵
PID:3820

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin" /E /G Admin:F /C
1⤵
PID:8208
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:6176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000A7.bin" -nobanner
  2⤵
  PID:8424
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"
  2⤵
  PID:8092
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C
  2⤵
  PID:7100

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6512

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000058.bin" -nobanner
1⤵
PID:5744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000058.bin" -nobanner
1⤵
PID:6140

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin"
1⤵
- Modifies file permissions
PID:8456
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000085.bin" -nobanner
  2⤵
  PID:6192

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6988

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"
1⤵
PID:8120

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C
1⤵
PID:6992

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6392
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:5964
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C
  2⤵
  PID:5256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000018.bin" -nobanner
1⤵
PID:8616

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin"
1⤵
PID:7648

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin" /E /G Admin:F /C
1⤵
PID:532
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000083.bin" -nobanner
  2⤵
  PID:9196

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7252

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000010.bin" -nobanner
1⤵
PID:8412
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "0000007R.bin" -nobanner
  2⤵
  PID:8336

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin"
1⤵
PID:8472

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin" /E /G Admin:F /C
1⤵
PID:7948
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "000000A9.bin" -nobanner
  2⤵
  PID:9052

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000F.bin" -nobanner
1⤵
PID:9104

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000004.bin" -nobanner
1⤵
PID:7372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000004.bin" -nobanner
1⤵
PID:280
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000072.bin" -nobanner
  2⤵
  PID:5244

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"
1⤵
PID:888

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000B7.bin" -nobanner
1⤵
PID:4636

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AV.bin" -nobanner
1⤵
PID:7620

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin"
1⤵
PID:6108
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:8584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000013.bin" -nobanner
  2⤵
  PID:5140
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin" /E /G Admin:F /C
  2⤵
  PID:6048

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7908

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin"
1⤵
PID:6480

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin" /E /G Admin:F /C
1⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000A4.bin" -nobanner
1⤵
PID:7440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000A4.bin" -nobanner
1⤵
PID:5908

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin"
1⤵
- Modifies file permissions
PID:7768
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "000000AJ.bin" -nobanner
  2⤵
  PID:1404

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin" /E /G Admin:F /C
1⤵
PID:5800

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009D.bin" -nobanner
1⤵
PID:5304

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin"
1⤵
- Modifies file permissions
PID:6160

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin" /E /G Admin:F /C
1⤵
PID:6336

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006P.bin" -nobanner
1⤵
PID:7716

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8076

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006H.bin" -nobanner
1⤵
PID:9040

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin"
1⤵
- Modifies file permissions
PID:5484

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin" /E /G Admin:F /C
1⤵
PID:6060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AN.bin" -nobanner
1⤵
PID:5536

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin"
1⤵
PID:6968

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin" /E /G Admin:F /C
1⤵
PID:3300

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000009M.bin" -nobanner
  2⤵
  PID:6260
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C
  2⤵
  PID:8456

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000AF.bin" -nobanner
1⤵
PID:7972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AF.bin" -nobanner
1⤵
PID:7900

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin"
1⤵
- Modifies file permissions
PID:7784

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin" /E /G Admin:F /C
1⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000A6.bin" -nobanner
1⤵
PID:7592

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6892

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000083.bin" -nobanner
1⤵
PID:532

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin"
1⤵
- Modifies file permissions
PID:7100

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin" /E /G Admin:F /C
1⤵
PID:1408

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7684

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000073.bin" -nobanner
1⤵
PID:6740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000073.bin" -nobanner
1⤵
PID:8452

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin" /E /G Admin:F /C
1⤵
PID:6736

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006J.bin" -nobanner
1⤵
PID:6008

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin"
1⤵
PID:8508

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin" /E /G Admin:F /C
1⤵
PID:5824

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:2852

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.08cce21c-43a0-40eb-99e4-681f9cf37841.1.etl"
1⤵
PID:308

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.08cce21c-43a0-40eb-99e4-681f9cf37841.1.etl" /E /G Admin:F /C
1⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.1.etl" -nobanner
1⤵
PID:2788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.1.etl" -nobanner
1⤵
PID:3100

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.1.etl"
1⤵
PID:5692

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000013.bin" -nobanner
1⤵
PID:4920

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000I.bin" -nobanner
1⤵
PID:7156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000I.bin" -nobanner
1⤵
PID:6384
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000B5.bin" -nobanner
  2⤵
  PID:8636
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin"
  2⤵
  PID:5756
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin" /E /G Admin:F /C
  2⤵
  PID:6268

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin"
1⤵
PID:6816

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6356

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin"
1⤵
PID:5464

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin" /E /G Admin:F /C
1⤵
PID:7276
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:6384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000006.bin" -nobanner
  2⤵
  PID:9060
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"
  2⤵
  PID:220
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C
  2⤵
  PID:8112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000011.bin" -nobanner
1⤵
PID:7576
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:4488
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin"
  2⤵
  PID:6564
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin" /E /G Admin:F /C
  2⤵
  PID:8644

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin"
1⤵
PID:6220

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin" /E /G Admin:F /C
1⤵
PID:6688

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000P.bin" -nobanner
1⤵
PID:1416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000P.bin" -nobanner
1⤵
PID:7812

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin" /E /G Admin:F /C
1⤵
PID:6596

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000005.bin" -nobanner
1⤵
PID:5872
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "00000017.bin" -nobanner
  2⤵
  PID:7884

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin"
1⤵
- Modifies file permissions
PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
  2⤵
  PID:7796
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
  2⤵
  PID:5504
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
  2⤵
  PID:5364

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin" /E /G Admin:F /C
1⤵
PID:756

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000B3.bin" -nobanner
1⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7876
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:5788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "vcredist_x64.exe" -nobanner
  2⤵
  PID:4132
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"
  2⤵
  PID:6984
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:7508
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /E /G Admin:F /C
  2⤵
  PID:5248

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000AP.bin" -nobanner
1⤵
PID:6748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AP.bin" -nobanner
1⤵
PID:7928

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin"
1⤵
- Modifies file permissions
PID:4132
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "vcredist_x64.exe" -nobanner
  2⤵
  PID:6448

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin" /E /G Admin:F /C
1⤵
PID:5896

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000AH.bin" -nobanner
1⤵
PID:7136

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3624

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin"
1⤵
- Modifies file permissions
PID:7944

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin" /E /G Admin:F /C
1⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000099.bin" -nobanner
1⤵
PID:8592

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin"
1⤵
PID:6276
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.a0d58d05-8968-42ef-b9e5-c4efc68f70a9.1.etl" -nobanner
  2⤵
  PID:3440

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin" /E /G Admin:F /C
1⤵
PID:6552

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8540

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl"
1⤵
PID:5864

C:\Windows\SysWOW64\cacls.exe
cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl" /E /G Admin:F /C
1⤵
PID:4580

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000007T.bin" -nobanner
1⤵
PID:1384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007T.bin" -nobanner
1⤵
PID:9088

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin" /E /G Admin:F /C
1⤵
PID:8352

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin"
1⤵
PID:7744

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin" /E /G Admin:F /C
1⤵
PID:8788

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006L.bin" -nobanner
1⤵
PID:6836

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000006D.bin" -nobanner
1⤵
PID:5772
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7852
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin"
  2⤵
  PID:6464
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin" /E /G Admin:F /C
  2⤵
  PID:6504

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000015.bin" -nobanner
1⤵
PID:6464

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin"
1⤵
- Modifies file permissions
PID:276

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:9064

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "00000009.bin" -nobanner
1⤵
PID:6856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000009.bin" -nobanner
1⤵
PID:7892

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin"
1⤵
PID:7020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "Workflow.Targets" -nobanner
  2⤵
  PID:8072
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
  2⤵
  PID:8260

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin" /E /G Admin:F /C
1⤵
PID:8560

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000B5.bin" -nobanner
1⤵
PID:8608

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "000000AJ.bin" -nobanner
1⤵
PID:7768

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin"
1⤵
PID:5900

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin" /E /G Admin:F /C
1⤵
PID:6148

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl" -nobanner
1⤵
PID:4396
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000008.bin" -nobanner
  2⤵
  PID:8240
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"
  2⤵
  PID:7720
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C
  2⤵
  PID:5776

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:7248

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
1⤵
PID:5896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
1⤵
PID:9112

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
1⤵
PID:8516

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
1⤵
PID:8612
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "vc_runtimeMinimum_x64.msi" -nobanner
  2⤵
  PID:7420
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\All Users\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi"
  2⤵
  PID:5532

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl" -nobanner
1⤵
PID:8660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl" -nobanner
1⤵
PID:6136
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7096
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl" -nobanner
    3⤵
    PID:6312
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl"
    3⤵
    PID:8516
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.506c8977-7673-47c2-a08b-a54b89b03558.1.etl" /E /G Admin:F /C
    3⤵
    PID:6600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000000D.bin" -nobanner
  2⤵
  PID:8028
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin"
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin" /E /G Admin:F /C
  2⤵
  PID:7056
- - C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
    ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "cab1.cab" -nobanner
    3⤵
    PID:7912
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab" /E /G Admin:F /C
    3⤵
    PID:3544

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.4e768468-a1d2-4927-9df0-427e21a486ca.1.etl" /E /G Admin:F /C
1⤵
PID:8944

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000087.bin" -nobanner
1⤵
PID:7844

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin"
1⤵
- Modifies file permissions
PID:8628

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin" /E /G Admin:F /C
1⤵
PID:8188

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8456

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007V.bin" -nobanner
1⤵
PID:6428

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin" /E /G Admin:F /C
1⤵
PID:8120

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:6620

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"
1⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8824

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"
1⤵
PID:8360

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C
1⤵
PID:8472

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:9180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:5984

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C
1⤵
PID:8512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000006F.bin" -nobanner
1⤵
PID:8316

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin"
1⤵
PID:8084

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin" /E /G Admin:F /C
1⤵
PID:7212

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:7496

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "Workflow.Targets" -nobanner
1⤵
PID:4920
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:8372
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"
  2⤵
  - Modifies file permissions
  PID:4836
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C
  2⤵
  PID:6476

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
1⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "background.png" -nobanner
1⤵
PID:8368
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:7208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000014.bin" -nobanner
  2⤵
  PID:7768
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"
  2⤵
  - Modifies file permissions
  PID:6960
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C
  2⤵
  PID:6628

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"
1⤵
PID:5236

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C
1⤵
PID:7692

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl" -nobanner
1⤵
PID:7532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl" -nobanner
1⤵
PID:2116

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl"
1⤵
PID:6688

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.be716218-c766-4012-bd0a-6b9b34b8195a.1.etl" /E /G Admin:F /C
1⤵
PID:5440

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:3108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "StorageHealthModel.dat" -nobanner
1⤵
PID:6316

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat"
1⤵
PID:6300
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "KnownGameList.bin" -nobanner
  2⤵
  PID:6920

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C
1⤵
PID:6776

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "overlay.png" -nobanner
1⤵
PID:6284

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"
1⤵
PID:8040

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C
1⤵
PID:7144
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl" -nobanner
  2⤵
  PID:6904

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000009M.bin" -nobanner
1⤵
PID:6968
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
  2⤵
  PID:8808

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000007Q.bin" -nobanner
1⤵
PID:6892

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"
1⤵
PID:1688
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
  2⤵
  PID:6664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl" -nobanner
  2⤵
  PID:5220
- C:\Windows\SysWOW64\takeown.exe
  takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl"
  2⤵
  - Modifies file permissions
  PID:8596
- C:\Windows\SysWOW64\cacls.exe
  cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.9ad038ae-5f58-4794-a32e-adc58517249f.2.etl" /E /G Admin:F /C
  2⤵
  PID:9052

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C
1⤵
PID:7932

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000007I.bin" -nobanner
1⤵
PID:9008

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:300

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000072.bin" -nobanner
1⤵
PID:280

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"
1⤵
- Modifies file permissions
PID:6272

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C
1⤵
PID:8860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000052.bin" -nobanner
1⤵
PID:9168

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"
1⤵
- Modifies file permissions
PID:1708

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C
1⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000000H.bin" -nobanner
1⤵
PID:8528

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:7380

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"
1⤵
PID:6576

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C
1⤵
PID:6324

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:6452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl" -nobanner
1⤵
PID:9156

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl"
1⤵
- Modifies file permissions
PID:3672
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
  2⤵
  PID:1968

C:\Windows\SysWOW64\cacls.exe
cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b51a0a29-a3b8-4fdf-8108-e79b0fc6fd9b.1.etl" /E /G Admin:F /C
1⤵
PID:8280

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "vc_runtimeMinimum_x64.msi" -nobanner
1⤵
PID:9208

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "cab1.cab" -nobanner
1⤵
PID:6496

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "000000A7.bin" -nobanner
1⤵
PID:6640
- C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
  ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
  2⤵
  PID:9088

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "settings.dat" -nobanner
1⤵
PID:7512

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat"
1⤵
PID:5616

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
1⤵
PID:6836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008L.bin" -nobanner
1⤵
PID:5548

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C
1⤵
PID:8880

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8660

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
1⤵
PID:3624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoViewer.dll.mui" -nobanner
1⤵
PID:5704

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"
1⤵
- Modifies file permissions
PID:2800

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C
1⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:8136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "PhotoAcq.dll.mui" -nobanner
1⤵
PID:6640

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"
1⤵
- Modifies file permissions
PID:8900

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C
1⤵
PID:7360

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5536

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
1⤵
PID:6460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "ImagingDevices.exe.mui" -nobanner
1⤵
PID:9172

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"
1⤵
- Modifies file permissions
PID:6940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "wab.exe" -nobanner
1⤵
PID:5500

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C
1⤵
PID:7684

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:5548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "00000091.bin" -nobanner
1⤵
PID:5628

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin"
1⤵
PID:6400

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin" /E /G Admin:F /C
1⤵
PID:7152

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula "0000008N.bin" -nobanner
1⤵
PID:7372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008N.bin" -nobanner
1⤵
PID:5264

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"
1⤵
PID:888

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C
1⤵
PID:7212

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe
ZRVIZhg9.exe -accepteula -c Run -y -p extract -nobanner
1⤵
PID:1216

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ZRVIZhg9.exe -accepteula "0000008F.bin" -nobanner
1⤵
PID:920

C:\Windows\SysWOW64\takeown.exe
takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"
1⤵
PID:836

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe

Filesize
181KB

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZRVIZhg9.exe

Filesize
149KB

MD5
54be8b3efe20a65f3a885c3b164de3cb

SHA1
017de2db12180c4e1ff7c0d7f59eb88f0cda4d77

SHA256
92182df4256a131b8d66b01efad4dd4936a348ec21bb873c8c03a11fc99702d7

SHA512
bce3c8ffdbaf6e620f01046f48b472e2b226cff20e6eb7872524678254d3b896ee1153f438be602f9cd985e2247f4eb84f01000896d9891e1ca8e4a9242ac599

Download Submit
C:\Users\Admin\AppData\Roaming\0WytFXFa.bat

Filesize
265B

MD5
6d90c1be20477a50d6c5469f2d9ca35d

SHA1
49916f81c1cc3ac90cc6c87113e349bf3dfad835

SHA256
855fe630b4c4028fe8b16d52bcaee2b889929cefa2852b5aa439bba38edc81a2

SHA512
dec9cddda35133c7f1a7829688a405ad6815616edc0ee9f2436cdd34fab97f2080fa8f55fbd4c496c67d0ac46dbe757b2c555442c9c789cbb67248dcf54b7de4

Download Submit
memory/180-9493-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/276-12777-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/296-12779-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/464-7-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download
memory/464-8-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/464-3-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/464-0-0x0000000001210000-0x0000000001211000-memory.dmp

Filesize
4KB

Download
memory/464-6-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/464-1-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/464-2-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/464-4-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/464-9491-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/464-5-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/464-9-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/1688-12661-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1976-12699-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3800-12735-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4188-12642-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4392-20-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/4392-29-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/4392-22-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/4392-26-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/4392-25-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/4392-28-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/4392-23-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/4392-21-0x0000000001120000-0x0000000001121000-memory.dmp

Filesize
4KB

Download
memory/4392-24-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/4392-9501-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/4812-12711-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4864-12755-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4864-12757-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4932-12645-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4932-12646-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5204-12705-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5316-12721-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5484-12688-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5756-12747-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5756-12773-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5764-12713-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5824-9649-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5824-12657-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5940-12812-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6036-12807-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6084-12674-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6084-11859-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6088-9928-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6116-12750-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6116-12776-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6136-12685-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6168-12709-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6196-12701-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6412-12753-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6500-12818-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6504-12785-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6564-12726-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6640-12681-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6664-12663-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6692-9481-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6692-12644-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6716-12817-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6716-12795-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6756-9490-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6812-12670-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6856-9497-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6896-12799-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7056-12691-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7056-12690-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7060-12707-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7204-12729-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7212-12771-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7276-12741-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7344-12738-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7348-12790-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7364-12703-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7376-9499-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7420-12697-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7536-12788-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7536-12808-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7544-12763-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7572-12801-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7608-12767-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7672-12797-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7700-12715-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7704-12759-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7704-12786-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7848-12650-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7848-12651-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7912-12815-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7948-12666-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7976-12655-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8028-12820-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8064-12803-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8120-12805-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8184-12822-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8360-12792-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8456-12668-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8516-12695-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8604-12659-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8608-10916-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8608-11067-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8608-12744-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8644-12723-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8668-12783-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8728-12769-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8760-12774-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8776-12672-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8776-12648-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8788-12676-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8912-12678-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8912-12679-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8956-12732-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8992-12683-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9100-12693-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9124-12810-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9188-12765-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9204-12653-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download