Analysis
- max time kernel
148s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
14/04/2026, 04:30
General
- Target 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe
- Size 1.2MB
- Sample260414-e444zaft8s
- SHA256 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e
Score
10/10
Malware Config
Signatures
- Family: Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Drops file in Drivers directory 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 64 IoCs
- Modifies file permissions 1 TTPs 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 27 IoCs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe"C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe"1⤵
- Family: Matrix Ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe" "C:\Users\Admin\AppData\Local\Temp\NWJ6ksKi.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NWJ6ksKi.exe"C:\Users\Admin\AppData\Local\Temp\NWJ6ksKi.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\fQplg5rN.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\fQplg5rN.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\OPd61Ro6.vbs"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\OPd61Ro6.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\8lpgcVFb.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\8lpgcVFb.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\DDF.sys""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\DDF.sys" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\DDF.sys"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "DDF.sys" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "DDF.sys" -nobanner4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR64.execYB2LqMR.exe -accepteula "DDF.sys" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ActivitiesCache.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ActivitiesCache.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "store.db" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "Workflow.Targets" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "Workflow.Targets" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "manifest.json" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "manifest.json" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "wabmig.exe" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "BrowserCore.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "BrowserCore.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wab.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "wab.exe" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "BrowserCore.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "BrowserCore.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "Identity-V" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "CompatExceptions.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "CompatExceptions.DATA" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\fr.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\fr.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\fr.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "fr.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "fr.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\hu.pak.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\hu.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\hu.pak.DATA"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "hu.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "hu.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\kn.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\kn.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\kn.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "kn.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "kn.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mk.pak.DATA""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mk.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mk.pak.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "mk.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "mk.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\nn.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\nn.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\nn.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "nn.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "nn.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ru.pak.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ru.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\ru.pak.DATA"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ru.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ru.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ta.pak""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ta.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ta.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ta.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ta.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\vi.pak.DATA""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\vi.pak.DATA" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\vi.pak.DATA"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "vi.pak.DATA" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "vi.pak.DATA" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sk.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sk.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sk.pak"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "sk.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "sk.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\te.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\te.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\te.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "te.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "te.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\zh-CN.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\zh-CN.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\zh-CN.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "zh-CN.pak" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "zh-CN.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "wabmig.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ug.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ug.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ug.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ug.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ug.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "MicrosoftEdge_X64_139.0.3405.125.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "MicrosoftEdge_X64_139.0.3405.125.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f34241b5-235b-4e29-9645-4fc605891c80.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f34241b5-235b-4e29-9645-4fc605891c80.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f34241b5-235b-4e29-9645-4fc605891c80.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "UpdateSessionOrchestration.f34241b5-235b-4e29-9645-4fc605891c80.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "UpdateSessionOrchestration.f34241b5-235b-4e29-9645-4fc605891c80.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ActivitiesCache.db-shm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ActivitiesCache.db-shm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "Identity-H" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "Identity-H" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\tt.pak""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\tt.pak" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\tt.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "tt.pak" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "tt.pak" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "msedge.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "msedge.exe" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000U.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000016.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000016.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000056.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000056.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.fa49311f-3d51-4c12-8813-8eff65f97a32.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.fa49311f-3d51-4c12-8813-8eff65f97a32.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.fa49311f-3d51-4c12-8813-8eff65f97a32.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "WuProvider.fa49311f-3d51-4c12-8813-8eff65f97a32.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "WuProvider.fa49311f-3d51-4c12-8813-8eff65f97a32.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.47d06c89-945a-4e42-9824-3eac040858b7.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.47d06c89-945a-4e42-9824-3eac040858b7.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.47d06c89-945a-4e42-9824-3eac040858b7.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "UpdateSessionOrchestration.47d06c89-945a-4e42-9824-3eac040858b7.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "UpdateSessionOrchestration.47d06c89-945a-4e42-9824-3eac040858b7.1.etl" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "wab.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.6498864a-5f94-4d2a-a384-b26bcd9664db.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.6498864a-5f94-4d2a-a384-b26bcd9664db.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.6498864a-5f94-4d2a-a384-b26bcd9664db.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "WuProvider.6498864a-5f94-4d2a-a384-b26bcd9664db.1.etl" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "WuProvider.6498864a-5f94-4d2a-a384-b26bcd9664db.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006U.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000076.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000076.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007E.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007E.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.a204a8b8-40b6-4b58-87ba-a8e247292deb.1.etl""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.a204a8b8-40b6-4b58-87ba-a8e247292deb.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.a204a8b8-40b6-4b58-87ba-a8e247292deb.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "NotificationUxBroker.a204a8b8-40b6-4b58-87ba-a8e247292deb.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "NotificationUxBroker.a204a8b8-40b6-4b58-87ba-a8e247292deb.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000008F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000008F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000008N.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000008N.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000091.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000091.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000091.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A0.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000A0.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000A0.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A9.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000A9.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000A9.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "classes.jsa" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000007.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000007.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000I.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000I.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000R.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000R.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000013.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000013.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000073.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000073.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000073.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007R.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007R.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007R.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000083.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000083.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000083.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009F.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000009F.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000009F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A6.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000A6.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000A6.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AF.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000AF.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000AF.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AN.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000AN.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000AN.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B1.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000B1.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000B1.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "watermark.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "watermark.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOShared\Logs\System\MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "MoUsoCoreWorker.cd0dfc4b-4ec2-44f2-b3e6-54cdd00d2623.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000008.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000008.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000J.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000014.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000014.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000054.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000054.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "TileCache_100_0_Data.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "TileCache_100_0_Data.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000009.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000009.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000T.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000T.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000015.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000015.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000075.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000075.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000075.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007T.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007T.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007T.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006S.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000085.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000085.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000085.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007C.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007K.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007K.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000008D.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000008D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000008L.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000008L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000008V.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000008V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000099.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000099.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000099.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000009H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000009H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000A7.bin" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000A7.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000005.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000005.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000G.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000G.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000P.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000P.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000011.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000011.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "KnownGameList.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "KnownGameList.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000006.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000006.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000H.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000000Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000000Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000012.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000012.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000052.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000052.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000072.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000072.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007A.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007A.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007I.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007I.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000007Q.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000007Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000008J.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000008J.bin" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000095.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000095.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000009M.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000009M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AH.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000AH.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000AH.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000AP.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000AP.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000AP.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000B3.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "000000B3.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "000000B3.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "TileCache_100_0_Header.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "TileCache_100_0_Header.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "settings.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "settings.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "superbar.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "superbar.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006H.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006P.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "0000006P.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "0000006P.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000081.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000081.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000081.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000089.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cYB2LqMR.exe -accepteula "00000089.bin" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula "00000089.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cYB2LqMR.execYB2LqMR.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mgl7X8aM.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008R.bin"3⤵
-
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet1⤵
- Interacts with shadow copies
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\8lpgcVFb.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
#MKES_INFO#.rtf
[[email protected]].6yRNS5pi-CJIDfigM.MKES
[[email protected]].7NZCzD4Z-tTsldFq3.MKES
[[email protected]].TMVnQPP8-MWG3GycQ.MKES
[[email protected]].UaXBkkH4-nga4B8Ky.MKES
[[email protected]].VQZ7xHh7-TFFsBlk2.MKES
[[email protected]].WNewDsgO-5Yd5gR43.MKES
[[email protected]].glDLhACh-Gf7fJEg5.MKES
[[email protected]].l5bm7paB-zl7Fb4zz.MKES
[[email protected]].pXet8TqI-axVeQUUB.MKES
[[email protected]].xCtWgpNN-7oyV6PG2.MKES
te.pak
[[email protected]].byLsrEOh-Xe5TyIDv.MKES
[[email protected]].5pO4mOKk-qaS1e0oy.MKES
[[email protected]].DnoVLQqs-EPNIKEMI.MKES
[[email protected]].bWT0Fh2A-rBLidQw2.MKES
[[email protected]].LR3HuZHo-gJA7zq4y.MKES
[[email protected]].dYlozKMp-6jCspWl8.MKES
[[email protected]].fIweYEWb-Znk6cgUf.MKES
[[email protected]].equfLZCF-u42i8B2P.MKES
[[email protected]].yIgN1kRc-pxwCpTG0.MKES
[[email protected]].p0xEKamL-yWT7sy5a.MKES
[[email protected]].5f1YKXeW-HUInuQ9E.MKES
[[email protected]].zoTYwooX-6fFuMC6Q.MKES
[[email protected]].sZgoOFq1-xbKsB68Y.MKES
[[email protected]].ogZNTXSX-ZYUaCtQy.MKES
[[email protected]].0t39s8zu-aAQrkk1a.MKES
[[email protected]].3EJLE3Ok-uov0cxGu.MKES
[[email protected]].3R3YpiUF-DCi0zHce.MKES
[[email protected]].4u4u3kYe-xWOj55FK.MKES
[[email protected]].6WbHM3az-vACzhlmd.MKES
[[email protected]].6zdcRbjY-3kzMpMLU.MKES
[[email protected]].78eym0ju-r2Mc7avm.MKES
[[email protected]].7wHHASj1-ZlCBfA5t.MKES
[[email protected]].DNmklWoh-BR8vRGfh.MKES
[[email protected]].GigvpMWC-TGHJQvV1.MKES
[[email protected]].LLpH3Qcz-O2R6ZPFJ.MKES
[[email protected]].N2p6wPlk-IT6huCB0.MKES
[[email protected]].OMuPN05X-5ziuBQMn.MKES
[[email protected]].PduPMyv2-MQ2KsSqc.MKES
[[email protected]].PhvPpa5o-MMg3IY1m.MKES
[[email protected]].PpJC3Dpk-Ey7vjKHE.MKES
[[email protected]].TyYjrELb-KYx2P5kx.MKES
[[email protected]].TzmRrIMM-QHG3MOZD.MKES
[[email protected]].Uh9SfQa6-byGKj4FB.MKES
[[email protected]].UxCfFtUp-LZpCssrL.MKES
[[email protected]].WFJxiDgu-q9uukZY9.MKES
[[email protected]].YMrWvhzZ-tMw73hzz.MKES
[[email protected]].Yjua0K8n-21fKzPoc.MKES
[[email protected]].aC2JgmAt-p5p9MsTu.MKES
[[email protected]].cJZ1My3a-1P70nWpB.MKES
[[email protected]].ev5RCamN-Qg2f855J.MKES
[[email protected]].hEGkmIBJ-Bocj73jS.MKES
[[email protected]].hv7wlqeK-VyfRCB2o.MKES
[[email protected]].iK7eeG1n-NwCSrzHD.MKES
[[email protected]].ktBUMs9V-BKMDSipS.MKES
[[email protected]].lNpSNX86-GQ9amB0V.MKES
[[email protected]].m7RtGuWp-VBB8bExI.MKES
[[email protected]].maJ85Sbe-iey5NxA4.MKES
[[email protected]].omn9UUz0-RTety9dx.MKES
[[email protected]].qW4n76L6-46uCJMKR.MKES
[[email protected]].s7CqzMe3-3oYPxt8s.MKES
[[email protected]].tndEAPMk-PoFmykk5.MKES
[[email protected]].vRe7JXp7-cCq41uLI.MKES
[[email protected]].w78HNdbA-K5oqcvib.MKES
[[email protected]].wgxqjpd8-lB0U1rdj.MKES
[[email protected]].xqo1Sa1s-dIOJFfPL.MKES
[[email protected]].yd78CcwH-R9LCZcgP.MKES
fr.pak
kn.pak
nn.pak
ta.pak
tt.pak
ug.pak
[[email protected]].LEZGwpGU-X8AewTTh.MKES
[[email protected]].I0IoSwQy-3Aase5RP.MKES
[[email protected]].nl82pwQl-AUSJdFHD.MKES
[[email protected]].wcpWykJo-sPxYZJMx.MKES
[[email protected]].1kF0Ks0b-RXcCSrHZ.MKES
[[email protected]].2TFgGplI-NYs4QxDQ.MKES
[[email protected]].IQLMbomF-t3eUAetx.MKES
[[email protected]].KEhCFOGF-oLvajnnd.MKES
[[email protected]].XeY5ziQJ-r9qJIdRM.MKES
[[email protected]].NdwSrCSN-HIMOvim3.MKES
[[email protected]].mpD1zHgi-eUqYPuOg.MKES
[[email protected]].rvA5OTVX-vJnRoMwd.MKES
[[email protected]].0aR6AUby-TEtOCyBN.MKES
[[email protected]].2tXs1WM4-VMAMSvVZ.MKES
[[email protected]].9W7c3ShJ-dAHPKeCI.MKES
[[email protected]].wjt9bkMD-1t1ZQYfX.MKES
[[email protected]].4fk9lqvE-fmQi9syT.MKES
[[email protected]].Mo5yQ3JB-f4GfQ16f.MKES
[[email protected]].OnM5GAaR-O5ig300b.MKES
[[email protected]].YjW3tjqd-clj0W8zu.MKES
[[email protected]].ZdmvLDEQ-MvqE8Fws.MKES
[[email protected]].rLjSImpz-u0YZZojK.MKES
[[email protected]].UmomYYiV-g5NwNzIC.MKES
[[email protected]].0yG1fhIX-gpTJopeq.MKES
[[email protected]].0zYAosRG-RvgRVhSQ.MKES
[[email protected]].32KAbbNd-NI2PR4C5.MKES
[[email protected]].4xpGbiEm-KHOe9Z7Z.MKES
[[email protected]].6nMZkGve-kSljNGam.MKES
[[email protected]].7PiFhudK-i3LPQq9g.MKES
[[email protected]].84NEeOLr-iAe46vTp.MKES
[[email protected]].8UhXoYw0-eivhJ1MW.MKES
[[email protected]].8UlHXGWi-vraH1t7R.MKES
[[email protected]].9SK8q1To-spnQZzlS.MKES
[[email protected]].BU4Ckk7s-h97vm7bP.MKES
[[email protected]].D3bqeztr-weAjcGgb.MKES
[[email protected]].DqHGnivd-QrK5u5X0.MKES
[[email protected]].FOjJWf00-svuEvfJ6.MKES
[[email protected]].FYl1YDsN-jO1Qv9o4.MKES
[[email protected]].FjEP0eeh-yO9E4FPV.MKES
[[email protected]].G7eiNLW2-IYbuAF2E.MKES
[[email protected]].GlzrJJip-d5h1yepV.MKES
[[email protected]].JgBaUaPy-Gt70q3JB.MKES
[[email protected]].KLIoWL1V-hp4Q1VGB.MKES
[[email protected]].KmhkIggR-QYOWC1Zh.MKES
[[email protected]].N6jimiSz-aFTdJw8u.MKES
[[email protected]].OASQrbNY-gEtcc5Z6.MKES
[[email protected]].QHkI3WeP-ZacY9pg8.MKES
[[email protected]].SljGhnH5-IicU95lY.MKES
[[email protected]].St3ujou6-99vsn0L8.MKES
[[email protected]].USClnqlw-cMQfeK0B.MKES
[[email protected]].Wylu6YIv-z9YZVbiD.MKES
[[email protected]].YTWZZpM1-Gusm5x0F.MKES
[[email protected]].Yhg8gYCq-uYQj9iFr.MKES
[[email protected]].aXA7RzkE-CCJtIlFv.MKES
[[email protected]].bIQkPcOc-ZD1H11Ch.MKES
[[email protected]].ePJB4pnP-IKrcU6LX.MKES
[[email protected]].fxpqXtwN-9e2EchtL.MKES
[[email protected]].hqNdEFd4-OaKLv05A.MKES
[[email protected]].jwJGphch-Adn7WQXv.MKES
[[email protected]].kzgWxFJy-d9nAKWiO.MKES
[[email protected]].lGLCB9MP-80rb64Eo.MKES
[[email protected]].oYTZAFes-60vhOouu.MKES
[[email protected]].ojcHXvKs-RWsEND4k.MKES
[[email protected]].rRoJSucD-DvPXr430.MKES
[[email protected]].ulBat1zO-SFOp9K6S.MKES
[[email protected]].v7RD2ult-VkRVie0k.MKES
[[email protected]].vdOhWSVy-JJqk74eI.MKES
[[email protected]].vjUAgAzj-EAuIpTDb.MKES
[[email protected]].yXO43kMV-6aXebIsy.MKES
[[email protected]].ygRFKu1V-vJ71j2Dz.MKES
[[email protected]].z1oSEREO-NdRJl0zd.MKES
[[email protected]].zfWAhxy0-E0dAEO4h.MKES
[[email protected]].ziOa2InD-hEV0dRkS.MKES
sk.pak
zh-CN.pak
[[email protected]].v0Fr2P5C-BFTsRMD2.MKES
[[email protected]].0gYcKpOI-syReLc5l.MKES
[[email protected]].3DZcNC2E-H7jfkmjr.MKES
[[email protected]].5rwwauC9-chUAij3b.MKES
[[email protected]].6XG5hObB-713niwxr.MKES
[[email protected]].80t615RP-OUAXBdTp.MKES
[[email protected]].8qnsKROe-4iXOUx4Y.MKES
[[email protected]].BRczWmNi-kn2CZ4ns.MKES
[[email protected]].JnKwr5YO-aavOC5RU.MKES
[[email protected]].PtchNddA-GJrtYOSB.MKES
[[email protected]].Uv29XhwX-Mp5EDW14.MKES
[[email protected]].YYnzq4jU-Of7uQtsv.MKES
[[email protected]].aUmpIYVP-wVTasedT.MKES
[[email protected]].ahCU1HrL-xHo2BFBK.MKES
[[email protected]].ciMMtelT-1YCSgcYi.MKES
[[email protected]].cwjEhoYL-0X30vuC4.MKES
[[email protected]].eUiRudLt-ewFuWCA1.MKES
[[email protected]].iJgq8t7h-1SxXmcIL.MKES
[[email protected]].mNLmnNDR-c0yrDFo6.MKES
[[email protected]].o0Aw1H5w-P1wdr8n3.MKES
[[email protected]].qYg5kyGu-qZTPBqER.MKES
[[email protected]].wmDZr3QQ-SKHdUC8P.MKES
[[email protected]].de1cIrw7-750WrBRK.MKES
[[email protected]].D28yFY1X-A2cxpMQS.MKES
[[email protected]].Nu18lbZa-1YC3pEyb.MKES
[[email protected]].QdcRi61B-JV4qzzZY.MKES
[[email protected]].KxhoIhim-vonil1Ht.MKES
[[email protected]].SiFH94Rn-aRVKu8oZ.MKES
[[email protected]].UrLaL0Jm-53c8GupU.MKES
[[email protected]].flEzWChp-i4mcUUgb.MKES
[[email protected]].RmIiAwqe-ktgiXUn7.MKES
[[email protected]].hg1q8vOs-Rbg8wLXw.MKES
[[email protected]].lj3O4uHp-Scs35PvN.MKES
[[email protected]].0iTkvlg7-k1V8P8yv.MKES
[[email protected]].CmnEvHU7-8VKV1uUc.MKES
[[email protected]].fZlbVHyJ-b0BU94Yd.MKES
[[email protected]].qIDroXhh-Uijvu9S8.MKES
[[email protected]].hb0MTRn7-W3rNYZex.MKES
[[email protected]].rEaQ8OHC-FOM6sPIR.MKES
[[email protected]].SvuO2MK4-Co3kQHQY.MKES
[[email protected]].dPKBf89H-tlOQfcg3.MKES
[[email protected]].uDE2iBPr-Po8DBBLs.MKES
[[email protected]].1yutrggH-WQQFZFvb.MKES
[[email protected]].7uKtFuW6-9gqMuMCY.MKES
[[email protected]].ZhH5GRPq-oeWOjS4q.MKES
[[email protected]].iiX92iwI-zzFNJamU.MKES
[[email protected]].rnGjmmXF-Sc6E00a7.MKES
[[email protected]].P2FnmLI7-SCgdWHot.MKES
[[email protected]].d649chwi-SxMyvZX8.MKES
[[email protected]].nC4Tgb9L-OcNhFdl5.MKES
[[email protected]].sgEpd00R-b18JJoMG.MKES
[[email protected]].Pu3Q4QUz-IImdgHPE.MKES
[[email protected]].Q5w0Cz0U-9dx5bfgG.MKES
[[email protected]].RefMJFvh-HnD0pA4U.MKES
[[email protected]].iauFz2fz-FtEpkrrI.MKES
[[email protected]].5jjFEhvf-cxogf4Ck.MKES
[[email protected]].TpjFy2d5-cXrutZtS.MKES
[[email protected]].fPEfViOK-bXAMOTOo.MKES
[[email protected]].onhMijfv-eku8rgrK.MKES
[[email protected]].wJ0AuEPl-BC9Kt1i7.MKES
[[email protected]].xZZNPisN-U1Lpyb34.MKES
[[email protected]].ecjst9R4-z5xcKyI3.MKES
[[email protected]].xTsFSkE2-YteZU5qJ.MKES
[[email protected]].NMw4Ul5B-GOTkdZK8.MKES
[[email protected]].hALFj4RP-ghfwRQ1d.MKES
[[email protected]].daY3CGUT-8sIWE563.MKES
[[email protected]].BbK2IK2S-RHTFtalW.MKES
[[email protected]].JeEeTRsN-HRC8jpr5.MKES
[[email protected]].EV2fYL2n-idjhWTDH.MKES
[[email protected]].pBRzX2oa-HFCqQP1p.MKES
[[email protected]].K1hMhO2S-S5s28ZNA.MKES
[[email protected]].a3TchFyG-nJLS3qW9.MKES
[[email protected]].26h43HpX-brHeQtOO.MKES
[[email protected]].4tFFZKwZ-4TAlNeVn.MKES
[[email protected]].Arkkquza-yGnmt6fm.MKES
[[email protected]].DLBSNltJ-5dpexiow.MKES
[[email protected]].FZc0V6wE-z4zKDo5c.MKES
[[email protected]].GvkjkHMY-DEUsi3LZ.MKES
[[email protected]].KXZ1sdTg-DQKgbfHK.MKES
[[email protected]].KiT3u120-DRtYBzEs.MKES
[[email protected]].OL0YFKLh-JMw8fUhp.MKES
[[email protected]].Oj5nYVrn-jtRBfR6R.MKES
[[email protected]].RAzn19ti-dk1CJo4J.MKES
[[email protected]].SKq34Qop-yR5hqNrE.MKES
[[email protected]].YEihqnZN-fG83k0zM.MKES
[[email protected]].ahiv0pjJ-lqTedzwX.MKES
[[email protected]].dLbWgcnQ-BkeHpEL4.MKES
[[email protected]].eyhoesfK-dZNDDkEz.MKES
[[email protected]].j4vMzuc9-OrrPFF1v.MKES
[[email protected]].juzZsIOB-jK6pS6Wi.MKES
[[email protected]].kXhurq8K-PYGslrik.MKES
[[email protected]].nZVl7FiU-fCXosMwO.MKES
[[email protected]].qQPS3141-I8dbxBB2.MKES
[[email protected]].3yRRvvLg-fjWJACOJ.MKES
[[email protected]].4EUlQJNq-wuynAzba.MKES
[[email protected]].76hUNb9W-vEPq3GHG.MKES
[[email protected]].MRxFi3NR-UfHzFuyu.MKES
[[email protected]].UuxZlroP-Bv5BUWbO.MKES
[[email protected]].WMCljxd3-vPeCOwa2.MKES
[[email protected]].WuYsloAw-piAbycuh.MKES
[[email protected]].Zk2S0IBZ-yISZ92Vq.MKES
[[email protected]].bpLkr9aY-en6mmO2Y.MKES
[[email protected]].fKCDSYyi-EIKqGZHs.MKES
[[email protected]].wYkhrpWK-LfRDVIuc.MKES
hu.pak.DATA
mk.pak.DATA
ru.pak.DATA
vi.pak.DATA
[[email protected]].NmxoJYzF-2uFIBV33.MKES
CompatExceptions.DATA
[[email protected]].0TCjfKB4-UcLDhs79.MKES
[[email protected]].BU8wYdLJ-F9V5UIUD.MKES
[[email protected]].lfCSkQlN-EOpV1nXa.MKES
[[email protected]].mQu6IjTH-TkeHg9Wh.MKES
[[email protected]].mb20a4PK-vFUXgQvn.MKES
[[email protected]].A0mhuBPS-OLikYfQm.MKES
[[email protected]].Fz953VCE-MNo29sox.MKES
[[email protected]].IIaa1TTR-MQ4lBVct.MKES
[[email protected]].4vSUKYpQ-JvL0MGdq.MKES
[[email protected]].KbjoPWrU-0kjMvRi7.MKES
[[email protected]].nDpftnRa-smOaSHSq.MKES
[[email protected]].xlofskiN-7CCHNVE7.MKES
[[email protected]].hQDk0B75-608h3RC4.MKES
[[email protected]].OkdlxgOl-uNbb3cgz.MKES
[[email protected]].Ao2JiRzF-FduuVA57.MKES
[[email protected]].Bb7PB0je-Ti6Nh20X.MKES
[[email protected]].DKcsVdUh-aBfJlRTj.MKES
[[email protected]].emSPAb48-eBFldPKr.MKES
[[email protected]].u5UXIuXi-3jMrHkls.MKES
[[email protected]].zhu8u7Rj-PP4QsY4F.MKES
[[email protected]].7fbM60Hw-QeYRuEjq.MKES
[[email protected]].evbFhU6L-BF566Ovi.MKES
[[email protected]].atJ1GSZ1-1vV9SnKq.MKES
[[email protected]].i0kzPzk3-pzf2B5ib.MKES
[[email protected]].pguBEf5n-E6EouXFm.MKES
[[email protected]].FxMmvLbo-4FeaNDjj.MKES
[[email protected]].egxfCANE-IrOp6u8S.MKES
[[email protected]].cMx3JvRK-Ir2zI4uc.MKES
[[email protected]].jkCx5JJx-Ck4oOFOz.MKES
[[email protected]].NXvIX4mD-TjHdztuO.MKES
[[email protected]].RzpSoNne-8xdVa9aQ.MKES
[[email protected]].EGmXzoZr-hlHABVQH.MKES
[[email protected]].yaln6DlK-NkNWQApp.MKES
[[email protected]].GFzw2ch9-YoPqAXPO.MKES
[[email protected]].c7BqrljK-RJ1MYULY.MKES
[[email protected]].xOfyZCGS-PYooLaJE.MKES
[[email protected]].7QpNvdGB-H6iwMHe3.MKES
[[email protected]].kj994Myj-H3hHHo8T.MKES
[[email protected]].tdl1qUkS-2CTwSQaH.MKES
[[email protected]].a6Oe328P-pKHameus.MKES
NWJ6ksKi.exe
bad_0849026CE95DB646.txt
cYB2LqMR.exe
cYB2LqMR64.exe
mgl7X8aM.bat
8lpgcVFb.bat
OPd61Ro6.vbs
memory/64-13347-0x0000000000400000-0x0000000000477000-memory.dmp
memory/536-16584-0x0000000000400000-0x0000000000477000-memory.dmp
memory/724-16683-0x0000000000400000-0x0000000000477000-memory.dmp
memory/920-16627-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1324-16763-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1540-16709-0x0000000000400000-0x0000000000539000-memory.dmp
memory/1540-12611-0x0000000000400000-0x0000000000539000-memory.dmp
memory/1540-6865-0x0000000000400000-0x0000000000539000-memory.dmp
memory/1540-13406-0x0000000000400000-0x0000000000539000-memory.dmp
memory/1540-16597-0x0000000000400000-0x0000000000539000-memory.dmp
memory/1740-13360-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1804-16494-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1816-16617-0x0000000000400000-0x0000000000477000-memory.dmp
memory/1944-12733-0x0000000000C60000-0x0000000000C6A000-memory.dmp
memory/1944-12732-0x0000000002AC0000-0x0000000002AEF000-memory.dmp
memory/1972-16764-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2024-16555-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2032-12734-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2032-13350-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2032-12607-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2084-13381-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2104-16701-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2136-16651-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2372-16739-0x0000000000400000-0x0000000000477000-memory.dmp
memory/2412-6870-0x0000000000400000-0x0000000000539000-memory.dmp
memory/2412-16603-0x0000000000400000-0x0000000000539000-memory.dmp
memory/3040-16636-0x0000000000400000-0x0000000000477000-memory.dmp
memory/3168-16700-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4044-13384-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4196-16652-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4328-16680-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4332-16591-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4456-16581-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4788-16575-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4800-16579-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4892-16595-0x0000000000400000-0x0000000000477000-memory.dmp
memory/4896-16522-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5088-16586-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5092-16623-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5288-16698-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5316-16632-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5332-16545-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5524-16559-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5528-16533-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5540-15370-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5564-16664-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5648-16548-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5656-13364-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5656-16737-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5668-16609-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5676-16511-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5732-13354-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5780-16527-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5796-16792-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5888-16665-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5896-16668-0x0000000000400000-0x0000000000477000-memory.dmp
memory/5924-16539-0x00000000006E0000-0x0000000000E1F000-memory.dmp
memory/5928-16647-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6004-16573-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6012-16781-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6044-16604-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6116-13336-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6256-16696-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6260-16519-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6260-16517-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6316-13344-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6376-16642-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6384-16633-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6440-16715-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6492-16673-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6500-16514-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6500-16515-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6520-16616-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6572-16488-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6572-16486-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6604-16726-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6616-16654-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6616-16343-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6668-13396-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6776-16530-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6840-16662-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6940-16491-0x0000000000400000-0x0000000000477000-memory.dmp
memory/6984-16677-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7016-16553-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7024-16693-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7088-16497-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7120-13375-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7144-16614-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7156-16484-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7232-16503-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7368-16785-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7400-16565-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7492-16578-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7540-13387-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7544-16660-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7568-16759-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7592-14948-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7616-13328-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7652-16541-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7724-13393-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7728-16743-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7772-13369-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7788-13372-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7800-16749-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7872-16508-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7920-16566-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7976-16757-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7988-16659-0x0000000000400000-0x0000000000477000-memory.dmp
memory/7988-15134-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8012-16800-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8072-16557-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8128-13330-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8136-16787-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8160-16635-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8244-16689-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8272-16551-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8352-16691-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8364-16601-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8376-13390-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8420-16570-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8436-13341-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8496-16695-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8552-13357-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8588-13338-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8692-16730-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8760-16452-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8788-13367-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8884-13399-0x0000000000400000-0x0000000000477000-memory.dmp
memory/8932-16605-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9020-16687-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9044-16607-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9072-13351-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9084-16674-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9232-16568-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9276-16593-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9284-16589-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9304-16561-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9364-16618-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9380-16524-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9420-16506-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9484-16536-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9492-16770-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9516-16612-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9544-16641-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9564-16613-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9644-13334-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9660-13402-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9668-16582-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9684-16629-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9704-16670-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9728-15137-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9760-16760-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9784-16645-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9916-16543-0x0000000000400000-0x0000000000477000-memory.dmp
memory/9936-16599-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10032-16500-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10056-13378-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10068-16684-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10088-16621-0x0000000000400000-0x0000000000477000-memory.dmp
memory/10192-16744-0x0000000000400000-0x0000000000477000-memory.dmp