matrix | hxxp://Google[.]com

Analysis

max time kernel
1197s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://Google.com

Score

10^/10

matrix defense_evasion discovery evasion execution impact persistence ransomware spyware stealer upx

Malware Config

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Comms\UnistoreDB\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\_locales\lo\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Cyrl-RS\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\All Users\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\_locales\km\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fil-PH\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\_locales\mr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\310091\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

5692 bcdedit.exe
6872 bcdedit.exe
Drops file in Drivers directory 1 IoCs

Processes:

LTak7xej64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS LTak7xej64.exe

pid	process
5692	bcdedit.exe
6872	bcdedit.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	LTak7xej64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

LTak7xej64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	LTak7xej64.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 64 IoCs

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exeNWhtwTL5.exeLTak7xej.exeLTak7xej64.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exeLTak7xej.exechrome.exeLTak7xej.exe

pid	process
5116	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
1612	NWhtwTL5.exe
5776	LTak7xej.exe
9928	LTak7xej64.exe
7468	LTak7xej.exe
8872	LTak7xej.exe
8624	LTak7xej.exe
3936	LTak7xej.exe
8268	LTak7xej.exe
8428	LTak7xej.exe
3612	LTak7xej.exe
8708	LTak7xej.exe
6284	LTak7xej.exe
8720	LTak7xej.exe
10176	LTak7xej.exe
8656	LTak7xej.exe
2996	LTak7xej.exe
8692	LTak7xej.exe
7456	LTak7xej.exe
8080	LTak7xej.exe
5532	LTak7xej.exe
6308	LTak7xej.exe
6344	LTak7xej.exe
7352	LTak7xej.exe
7720	LTak7xej.exe
7544	LTak7xej.exe
9936	LTak7xej.exe
10092	LTak7xej.exe
7548	LTak7xej.exe
7524	LTak7xej.exe
7760	LTak7xej.exe
6956	LTak7xej.exe
7732	LTak7xej.exe
7156	LTak7xej.exe
7332	LTak7xej.exe
5520	LTak7xej.exe
5612	LTak7xej.exe
9852	LTak7xej.exe
1368	LTak7xej.exe
9504	LTak7xej.exe
7500	LTak7xej.exe
9340	LTak7xej.exe
9644	LTak7xej.exe
5508	LTak7xej.exe
6212	LTak7xej.exe
4628	LTak7xej.exe
9740	LTak7xej.exe
7120	LTak7xej.exe
7944	LTak7xej.exe
9628	LTak7xej.exe
7256	LTak7xej.exe
9024	LTak7xej.exe
6444	LTak7xej.exe
8876	LTak7xej.exe
9220	LTak7xej.exe
6472	LTak7xej.exe
4576	LTak7xej.exe
7360	LTak7xej.exe
10140	LTak7xej.exe
9044	LTak7xej.exe
10216	LTak7xej.exe
10136	LTak7xej.exe
9896	chrome.exe
3152	LTak7xej.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

pid	process
2216	takeown.exe
8524	takeown.exe
9408	takeown.exe
7972	takeown.exe
9908
7940
8320	takeown.exe
9272	takeown.exe
8392
368
8772	takeown.exe
9772	takeown.exe
9164	takeown.exe
10212
9188
6192	takeown.exe
9500
5880
7644
8564	takeown.exe
2376	takeown.exe
5180
5844
9320	takeown.exe
6680	takeown.exe
8780
9112
9072
7452
6140	takeown.exe
10088	takeown.exe
684	takeown.exe
9520	takeown.exe
1556	takeown.exe
7364	takeown.exe
2592	takeown.exe
3828	takeown.exe
8752	takeown.exe
5568	takeown.exe
4416	takeown.exe
9896	takeown.exe
7484
9272
10148
9904
9760	takeown.exe
8884	takeown.exe
8976
10184	takeown.exe
6440	takeown.exe
5092
7496
9340
5680	takeown.exe
8172
6800	takeown.exe
1904	takeown.exe
5612	takeown.exe
8548
8620	takeown.exe
5452	takeown.exe
9324	takeown.exe
9184	takeown.exe
7620	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/5776-12005-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7468-13541-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8872-13543-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8872-13545-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8624-13547-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/3936-13548-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8268-13549-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8428-13551-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8428-13553-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/3612-13554-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8708-13555-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8708-13557-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6284-13593-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8720-13594-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8720-13596-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/10176-13598-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8656-13600-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/2996-13602-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8692-13604-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7456-13606-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8080-13607-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8080-13609-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/5532-13611-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/5532-13613-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6308-13615-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6308-13617-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6344-13619-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7352-13622-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7720-13623-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7544-13626-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9936-13628-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/10092-13630-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7548-13635-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7524-13637-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7760-13640-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6956-13642-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7732-13644-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7156-13647-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7332-13650-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/5520-13651-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/5612-13653-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9852-13655-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1368-13657-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9504-13660-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7500-13662-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9340-13664-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9644-13666-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/5508-13668-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6212-13671-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/4628-13673-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9740-13676-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7120-13678-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7944-13680-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9628-13682-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7256-13687-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9024-13689-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6444-13692-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/8876-13694-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/9220-13696-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/6472-13698-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/4576-13700-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7360-13701-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/7360-13703-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/10140-13705-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Drops desktop.ini file(s) 27 IoCs

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exeLTak7xej64.exe

description	ioc	process
File opened (read-only)	\??\Y:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\U:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\M:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\J:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\Z:	LTak7xej64.exe
File opened (read-only)	\??\A:	LTak7xej64.exe
File opened (read-only)	\??\G:	LTak7xej64.exe
File opened (read-only)	\??\K:	LTak7xej64.exe
File opened (read-only)	\??\M:	LTak7xej64.exe
File opened (read-only)	\??\N:	LTak7xej64.exe
File opened (read-only)	\??\V:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\K:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\G:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\E:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\H:	LTak7xej64.exe
File opened (read-only)	\??\V:	LTak7xej64.exe
File opened (read-only)	\??\X:	LTak7xej64.exe
File opened (read-only)	\??\L:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\H:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\R:	LTak7xej64.exe
File opened (read-only)	\??\Y:	LTak7xej64.exe
File opened (read-only)	\??\P:	LTak7xej64.exe
File opened (read-only)	\??\X:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\R:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\P:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\O:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\N:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\J:	LTak7xej64.exe
File opened (read-only)	\??\L:	LTak7xej64.exe
File opened (read-only)	\??\O:	LTak7xej64.exe
File opened (read-only)	\??\W:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\S:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\Q:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\I:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\B:	LTak7xej64.exe
File opened (read-only)	\??\S:	LTak7xej64.exe
File opened (read-only)	\??\E:	LTak7xej64.exe
File opened (read-only)	\??\Q:	LTak7xej64.exe
File opened (read-only)	\??\T:	LTak7xej64.exe
File opened (read-only)	\??\U:	LTak7xej64.exe
File opened (read-only)	\??\W:	LTak7xej64.exe
File opened (read-only)	\??\Z:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\T:	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened (read-only)	\??\I:	LTak7xej64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

137 raw.githubusercontent.com
119 camo.githubusercontent.com
136 raw.githubusercontent.com

flow	ioc
137	raw.githubusercontent.com
119	camo.githubusercontent.com
136	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\KlHGMTit.bmp"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exeNWhtwTL5.exe

pid process

5116 095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
1612 NWhtwTL5.exe

Drops file in Program Files directory 64 IoCs

Processes:

095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\theme.png	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbUpOutline_22_N1.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\cy.pak.DATA	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\he.pak.DATA	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-ma\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\en-US.pak	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\skin.dtd	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management-agent.jar	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\PlayStore_icon.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\spectrum_spinner.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluNoSearchResults_180x160.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-default.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbUpOutline_22_N.svg	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\altDekstopCopyPasteHelper.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\AB89_INFO.rtf	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\ui-strings.js	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\new_icons.png	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\v8_context_snapshot.bin	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\nexturl.ort.DATA	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2948 schtasks.exe

pid	process
2948	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

6672 vssadmin.exe

pid	process
6672	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133604265623989137"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

chrome.exechrome.exe095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exeNWhtwTL5.exeLTak7xej64.exechrome.exechrome.exe

pid	process
744	chrome.exe
744	chrome.exe
3628	chrome.exe
3628	chrome.exe
5116	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
5116	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
5116	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
5116	095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
1612	NWhtwTL5.exe
1612	NWhtwTL5.exe
1612	NWhtwTL5.exe
1612	NWhtwTL5.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
9928	LTak7xej64.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
8448	chrome.exe
8448	chrome.exe
8448	chrome.exe
8448	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

LTak7xej64.exe

pid process

9928 LTak7xej64.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

744 chrome.exe
744 chrome.exe
744 chrome.exe
744 chrome.exe
744 chrome.exe
744 chrome.exe
744 chrome.exe

pid	process
9928	LTak7xej64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

chrome.exe7zG.exe7zG.exe

pid	process
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
3940	7zG.exe
3044	7zG.exe
744	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 744 wrote to memory of 4984	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 4984	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 1288	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 4260	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 4260	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe
PID 744 wrote to memory of 3192	744	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7b9ab58,0x7ffcb7b9ab68,0x7ffcb7b9ab78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:2
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4544 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4600 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  - Executes dropped EXE
  PID:9896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4596 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  PID:10188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5012 --field-trial-handle=1856,i,14483029040627338408,10210231764409776631,131072 /prefetch:1
  2⤵
  PID:10180

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4320

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\" -ad -an -ai#7zMap15429:190:7zEvent16295
1⤵
- Suspicious use of FindShellTrayWindow
PID:3940

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\" -ad -an -ai#7zMap21063:190:7zEvent24723
1⤵
- Suspicious use of FindShellTrayWindow
PID:3044

C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe
"C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe"
1⤵
- Matrix Ransomware
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe" "C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\NWhtwTL5.exe"
  2⤵
  PID:3376
- C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\NWhtwTL5.exe
  "C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\NWhtwTL5.exe" -n
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KlHGMTit.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KlHGMTit.bmp" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:3752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    PID:7908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\NMIjTWae.vbs"
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\NMIjTWae.vbs"
    3⤵
    - Checks computer location settings
    PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\8qCyH3KW.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\8qCyH3KW.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Creates scheduled task(s)
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      PID:7424
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:10028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak""
  2⤵
  PID:6936
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak" /E /G Admin:F /C
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-US.pak"
    3⤵
    PID:6252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "en-US.pak" -nobanner
    3⤵
    PID:5940
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "en-US.pak" -nobanner
      4⤵
      Executes dropped EXE
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\LTak7xej64.exe
        
        LTak7xej.exe -accepteula "en-US.pak" -nobanner
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        
        PID:9928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak""
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak" /E /G Admin:F /C
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak"
    3⤵
    PID:6792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "resources.pak" -nobanner
    3⤵
    PID:8012
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "resources.pak" -nobanner
      4⤵
      Executes dropped EXE
      PID:7468
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""
  2⤵
  PID:6684
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:8400
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"
    3⤵
    - Modifies file permissions
    PID:8620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "store.db" -nobanner
    3⤵
    PID:6544
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "store.db" -nobanner
      4⤵
      Executes dropped EXE
      PID:8624
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""
  2⤵
  PID:5180
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
    3⤵
    PID:8628
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
      4⤵
      Executes dropped EXE
      PID:8268
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db""
  2⤵
  PID:7208
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db" /E /G Admin:F /C
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db"
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ActivitiesCache.db" -nobanner
    3⤵
    PID:5872
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ActivitiesCache.db" -nobanner
      4⤵
      Executes dropped EXE
      PID:3612
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db""
  2⤵
  PID:7480
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db" /E /G Admin:F /C
    3⤵
    PID:6428
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db"
    3⤵
    PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "heavy_ad_intervention_opt_out.db" -nobanner
    3⤵
    PID:4552
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "heavy_ad_intervention_opt_out.db" -nobanner
      4⤵
      Executes dropped EXE
      PID:6284
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak""
  2⤵
  PID:7808
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak" /E /G Admin:F /C
    3⤵
    PID:8476
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak"
    3⤵
    PID:8492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "chrome_100_percent.pak" -nobanner
    3⤵
    PID:5512
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "chrome_100_percent.pak" -nobanner
      4⤵
      Executes dropped EXE
      PID:10176
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak""
  2⤵
  PID:8652
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak" /E /G Admin:F /C
    3⤵
    PID:8436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak"
    3⤵
    - Modifies file permissions
    PID:8320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "chrome_200_percent.pak" -nobanner
    3⤵
    PID:6696
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "chrome_200_percent.pak" -nobanner
      4⤵
      Executes dropped EXE
      PID:2996
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa""
  2⤵
  PID:7260
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa"
    3⤵
    PID:7440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:6096
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "classes.jsa" -nobanner
      4⤵
      Executes dropped EXE
      PID:7456
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
  2⤵
  PID:6296
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:6220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:2428
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:5532
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:6324
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:4452
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:6344
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""
  2⤵
  PID:8096
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"
    3⤵
    PID:7080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:6724
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:7720
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
  2⤵
  PID:6136
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:7636
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
    3⤵
    - Modifies file permissions
    PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "store.db" -nobanner
    3⤵
    PID:9536
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "store.db" -nobanner
      4⤵
      Executes dropped EXE
      PID:9936
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:10092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa""
  2⤵
  PID:9752
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa" /E /G Admin:F /C
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Java\jre-1.8\bin\server\classes.jsa"
    3⤵
    PID:9816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "classes.jsa" -nobanner
    3⤵
    PID:9716
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "classes.jsa" -nobanner
      4⤵
      Executes dropped EXE
      PID:7548
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""
  2⤵
  PID:5292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:9756
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"
    3⤵
    PID:10024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:6044
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:7760
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
  2⤵
  PID:6832
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:7816
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:7732
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""
  2⤵
  PID:6772
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"
    3⤵
    PID:9832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:9804
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:7332
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:5520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""
  2⤵
  PID:6740
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C
    3⤵
    PID:9792
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"
    3⤵
    PID:7716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "manifest.json" -nobanner
    3⤵
    PID:9540
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "manifest.json" -nobanner
      4⤵
      Executes dropped EXE
      PID:5612
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:9852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:9868
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
    3⤵
    PID:9440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:8380
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:1368
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:9504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""
  2⤵
  PID:9472
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:9388
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"
    3⤵
    PID:9956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:9576
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:7500
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:9340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""
  2⤵
  PID:5504
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:9348
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"
    3⤵
    PID:9428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:9604
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:9644
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:5508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
  2⤵
  PID:7940
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:7960
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
    3⤵
    PID:6988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:6960
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:6212
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""
  2⤵
  PID:6808
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:9724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner
    3⤵
    PID:7812
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner
      4⤵
      Executes dropped EXE
      PID:9740
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""
  2⤵
  PID:5384
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:6924
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:9320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:6464
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:7944
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:9628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Google\Chrome\Application\chrome.exe""
  2⤵
  PID:9572
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Google\Chrome\Application\chrome.exe" /E /G Admin:F /C
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:9664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "chrome.exe" -nobanner
    3⤵
    PID:7888
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "chrome.exe" -nobanner
      4⤵
      Executes dropped EXE
      PID:7256
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:9024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\DDF.sys""
  2⤵
  PID:9020
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\DDF.sys" /E /G Admin:F /C
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\DDF.sys"
    3⤵
    - Modifies file permissions
    PID:6140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "DDF.sys" -nobanner
    3⤵
    PID:5992
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "DDF.sys" -nobanner
      4⤵
      Executes dropped EXE
      PID:6444
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:8876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:8112
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:6192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:7056
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:9220
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:6472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:5332
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:1540
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:4576
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:7360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""
  2⤵
  PID:8832
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:388
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:10184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:1608
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:10140
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:9044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Mail\wab.exe""
  2⤵
  PID:8968
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C
    3⤵
    PID:8996
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Mail\wab.exe"
    3⤵
    - Modifies file permissions
    PID:6440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wab.exe" -nobanner
    3⤵
    PID:7444
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "wab.exe" -nobanner
      4⤵
      Executes dropped EXE
      PID:10216
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    - Executes dropped EXE
    PID:10136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""
  2⤵
  PID:5704
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:3092
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"
    3⤵
    PID:10128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:9944
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      Executes dropped EXE
      PID:3152
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""
  2⤵
  PID:9988
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:7604
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"
    3⤵
    PID:7588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:2876
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:8064
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""
  2⤵
  PID:7320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C
    3⤵
    PID:5148
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"
    3⤵
    PID:6052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "BrowserCore.exe" -nobanner
    3⤵
    PID:6020
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "BrowserCore.exe" -nobanner
      4⤵
      PID:8788
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
  2⤵
  PID:5912
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
    3⤵
    PID:8008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Workflow.Targets" -nobanner
    3⤵
    PID:8624
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Workflow.Targets" -nobanner
      4⤵
      PID:1860
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Mail\wabmig.exe""
  2⤵
  PID:2392
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C
    3⤵
    PID:8268
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Mail\wabmig.exe"
    3⤵
    - Modifies file permissions
    PID:8772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wabmig.exe" -nobanner
    3⤵
    PID:5268
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "wabmig.exe" -nobanner
      4⤵
      PID:8328
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""
  2⤵
  PID:9316
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:9760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:7696
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:6300
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""
  2⤵
  PID:8636
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:8724
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"
    3⤵
    PID:8032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:684
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:8532
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""
  2⤵
  PID:8180
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"
    3⤵
    PID:8448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "BrowserCore.exe.mui" -nobanner
    3⤵
    PID:6352
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "BrowserCore.exe.mui" -nobanner
      4⤵
      PID:7740
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
    3⤵
    PID:8256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:8484
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:8452
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""
  2⤵
  PID:10176
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:8660
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"
    3⤵
    PID:7192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:8640
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:8436
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""
  2⤵
  PID:6864
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:8544
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
    3⤵
    PID:7416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:1536
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:7440
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""
  2⤵
  PID:7780
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C
    3⤵
    PID:6332
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"
    3⤵
    - Modifies file permissions
    PID:8524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wabmig.exe" -nobanner
    3⤵
    PID:6512
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "wabmig.exe" -nobanner
      4⤵
      PID:5224
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui""
  2⤵
  PID:7876
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:6248
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui"
    3⤵
    PID:960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:5972
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:6728
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui""
  2⤵
  PID:4452
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:6252
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui"
    3⤵
    - Modifies file permissions
    PID:7364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:2352
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:5280
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
  2⤵
  PID:6724
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
    3⤵
    PID:9088
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
    3⤵
    - Modifies file permissions
    PID:9272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Workflow.Targets" -nobanner
    3⤵
    PID:6556
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Workflow.Targets" -nobanner
      4⤵
      PID:2216
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
  2⤵
  PID:8332
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:7688
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:6744
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:6716
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""
  2⤵
  PID:6648
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
    3⤵
    PID:7008
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
    3⤵
    PID:7636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner
    3⤵
    PID:6228
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe" -nobanner
      4⤵
      PID:9756
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui""
  2⤵
  PID:7312
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:7900
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:9772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:5488
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:6024
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui""
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:8028
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui"
    3⤵
    - Modifies file permissions
    PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:9304
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:2284
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:10096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui""
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:9624
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui"
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:9792
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:7936
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui""
  2⤵
  PID:8376
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:7496
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui"
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:5376
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:9440
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl""
  2⤵
  PID:9508
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl" /E /G Admin:F /C
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl"
    3⤵
    PID:9460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl" -nobanner
    3⤵
    PID:6752
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MoUsoCoreWorker.ba3c808c-7504-43e4-a568-7d35fba6f6ac.1.etl" -nobanner
      4⤵
      PID:4764
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl""
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl" /E /G Admin:F /C
    3⤵
    PID:9576
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl"
    3⤵
    PID:9336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl" -nobanner
    3⤵
    PID:9464
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "WuProvider.1f8bce32-c11f-44d8-8ba8-6a8b0e4ab604.1.etl" -nobanner
      4⤵
      PID:9372
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm""
  2⤵
  PID:9348
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm" /E /G Admin:F /C
    3⤵
    PID:9604
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm"
    3⤵
    - Modifies file permissions
    PID:5452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ActivitiesCache.db-shm" -nobanner
    3⤵
    PID:9600
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ActivitiesCache.db-shm" -nobanner
      4⤵
      PID:9612
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma""
  2⤵
  PID:6968
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma" /E /G Admin:F /C
    3⤵
    PID:9424
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma"
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "CrashpadMetrics-active.pma" -nobanner
    3⤵
    PID:7940
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "CrashpadMetrics-active.pma" -nobanner
      4⤵
      PID:3808
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001""
  2⤵
  PID:9724
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:5760
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001"
    3⤵
    PID:6796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:6808
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:4084
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1""
  2⤵
  PID:9320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1" /E /G Admin:F /C
    3⤵
    PID:6552
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1"
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner
    3⤵
    PID:9628
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_1" -nobanner
      4⤵
      PID:8024
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001""
  2⤵
  PID:9640
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:7256
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001"
    3⤵
    PID:9060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:9024
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:6820
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001""
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001"
    3⤵
    PID:9064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:9068
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:9020
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H""
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H"
    3⤵
    PID:8956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Identity-H" -nobanner
    3⤵
    PID:6632
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Identity-H" -nobanner
      4⤵
      PID:6064
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V""
  2⤵
  PID:8836
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V" /E /G Admin:F /C
    3⤵
    PID:8132
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V"
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Identity-V" -nobanner
    3⤵
    PID:6628
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Identity-V" -nobanner
      4⤵
      PID:7516
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
  2⤵
  PID:10080
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:6440
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:3976
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:3092
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui""
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:10040
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui"
    3⤵
    - Modifies file permissions
    PID:9164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:8908
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:7000
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui""
  2⤵
  PID:9208
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui"
    3⤵
    - Modifies file permissions
    PID:10088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:3436
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:4292
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl""
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl" /E /G Admin:F /C
    3⤵
    PID:7584
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl"
    3⤵
    PID:8124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl" -nobanner
    3⤵
    PID:7340
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MoUsoCoreWorker.adc60cc5-881a-4717-9b5b-b4b2a3c40fe9.1.etl" -nobanner
      4⤵
      PID:4172
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl""
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl" /E /G Admin:F /C
    3⤵
    PID:7076
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl"
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl" -nobanner
    3⤵
    PID:5352
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "WuProvider.069ffa7c-8b4b-400c-af4f-53ead9874bfc.1.etl" -nobanner
      4⤵
      PID:5308
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl""
  2⤵
  PID:3520
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl" /E /G Admin:F /C
    3⤵
    PID:8236
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl"
    3⤵
    PID:6544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl" -nobanner
    3⤵
    PID:8216
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "NotificationUxBroker.3583bdcf-47dc-4c4d-a9b1-186c5e758fd0.1.etl" -nobanner
      4⤵
      PID:292
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl""
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl" /E /G Admin:F /C
    3⤵
    PID:7092
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl"
    3⤵
    PID:5892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl" -nobanner
    3⤵
    PID:9244
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "WuProvider.e48c78fd-80b8-487d-89ea-ffef8f8a1ff7.1.etl" -nobanner
      4⤵
      PID:3176
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl""
  2⤵
  PID:5676
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl" /E /G Admin:F /C
    3⤵
    PID:920
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl"
    3⤵
    - Modifies file permissions
    PID:5680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl" -nobanner
    3⤵
    PID:5904
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MoUsoCoreWorker.60fb34de-d855-405c-a3f7-ded3d2929077.1.etl" -nobanner
      4⤵
      PID:6036
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1""
  2⤵
  PID:5872
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1" /E /G Admin:F /C
    3⤵
    PID:5212
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1"
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner
    3⤵
    PID:7532
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_1" -nobanner
      4⤵
      PID:7560
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index""
  2⤵
  PID:5128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index" /E /G Admin:F /C
    3⤵
    PID:7552
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index"
    3⤵
    - Modifies file permissions
    PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner
    3⤵
    PID:4216
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "index" -nobanner
      4⤵
      PID:6148
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl""
  2⤵
  PID:8248
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl" /E /G Admin:F /C
    3⤵
    PID:8492
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl"
    3⤵
    PID:8488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl" -nobanner
    3⤵
    PID:8572
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "UpdateSessionOrchestration.0f7459ae-470a-4c47-8db0-9d1e64e3f67a.1.etl" -nobanner
      4⤵
      PID:8740
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin""
  2⤵
  PID:8460
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin" /E /G Admin:F /C
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin"
    3⤵
    PID:8676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000008.bin" -nobanner
    3⤵
    PID:8688
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000008.bin" -nobanner
      4⤵
      PID:7952
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin""
  2⤵
  PID:8644
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin" /E /G Admin:F /C
    3⤵
    PID:7428
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin"
    3⤵
    PID:6232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000J.bin" -nobanner
    3⤵
    PID:6096
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000J.bin" -nobanner
      4⤵
      PID:5172
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin""
  2⤵
  PID:6276
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin" /E /G Admin:F /C
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin"
    3⤵
    PID:6512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000S.bin" -nobanner
    3⤵
    PID:6844
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000S.bin" -nobanner
      4⤵
      PID:4484
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin""
  2⤵
  PID:6268
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin" /E /G Admin:F /C
    3⤵
    PID:6728
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin"
    3⤵
    PID:6344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000014.bin" -nobanner
    3⤵
    PID:6264
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000014.bin" -nobanner
      4⤵
      PID:6296
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin""
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin" /E /G Admin:F /C
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin"
    3⤵
    PID:7368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000054.bin" -nobanner
    3⤵
    PID:5136
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000054.bin" -nobanner
      4⤵
      PID:3952
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index""
  2⤵
  PID:8168
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index" /E /G Admin:F /C
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index"
    3⤵
    PID:10076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner
    3⤵
    PID:4784
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "index" -nobanner
      4⤵
      PID:5336
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2""
  2⤵
  PID:7712
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2" /E /G Admin:F /C
    3⤵
    PID:6716
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2"
    3⤵
    PID:6396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_2" -nobanner
    3⤵
    PID:7408
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_2" -nobanner
      4⤵
      PID:10092
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1""
  2⤵
  PID:7564
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1" /E /G Admin:F /C
    3⤵
    PID:8036
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1"
    3⤵
    PID:9256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner
    3⤵
    PID:7348
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_1" -nobanner
      4⤵
      PID:7540
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin""
  2⤵
  PID:7900
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin" /E /G Admin:F /C
    3⤵
    PID:8020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006S.bin"
    3⤵
    PID:7856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000006S.bin" -nobanner
    3⤵
    PID:5292
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000006S.bin" -nobanner
      4⤵
      PID:7312
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin""
  2⤵
  PID:9168
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin" /E /G Admin:F /C
    3⤵
    PID:10000
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007C.bin"
    3⤵
    PID:9160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007C.bin" -nobanner
    3⤵
    PID:8784
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007C.bin" -nobanner
      4⤵
      PID:8028
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin""
  2⤵
  PID:9824
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin" /E /G Admin:F /C
    3⤵
    PID:6484
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007K.bin"
    3⤵
    PID:752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007K.bin" -nobanner
    3⤵
    PID:2296
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007K.bin" -nobanner
      4⤵
      PID:4564
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin""
  2⤵
  PID:9624
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin" /E /G Admin:F /C
    3⤵
    PID:9792
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008D.bin"
    3⤵
    - Modifies file permissions
    PID:5612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008D.bin" -nobanner
    3⤵
    PID:9620
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000008D.bin" -nobanner
      4⤵
      PID:6768
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin""
  2⤵
  PID:8360
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin" /E /G Admin:F /C
    3⤵
    PID:7396
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008L.bin"
    3⤵
    - Modifies file permissions
    PID:8884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008L.bin" -nobanner
    3⤵
    PID:7672
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000008L.bin" -nobanner
      4⤵
      PID:9532
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin""
  2⤵
  PID:7384
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin" /E /G Admin:F /C
    3⤵
    PID:8348
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008V.bin"
    3⤵
    PID:8384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008V.bin" -nobanner
    3⤵
    PID:9496
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000008V.bin" -nobanner
      4⤵
      PID:5812
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0""
  2⤵
  PID:9444
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0" /E /G Admin:F /C
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0"
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner
    3⤵
    PID:5452
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_0" -nobanner
      4⤵
      PID:3168
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History""
  2⤵
  PID:6924
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History" /E /G Admin:F /C
    3⤵
    PID:9332
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History"
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "History" -nobanner
    3⤵
    PID:9364
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "History" -nobanner
      4⤵
      PID:8024
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account""
  2⤵
  PID:9320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" /E /G Admin:F /C
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account"
    3⤵
    - Modifies file permissions
    PID:9324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Login Data For Account" -nobanner
    3⤵
    PID:8052
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Login Data For Account" -nobanner
      4⤵
      PID:9024
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies""
  2⤵
  PID:6356
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies" /E /G Admin:F /C
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\Safe Browsing Cookies"
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Safe Browsing Cookies" -nobanner
    3⤵
    PID:8156
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Safe Browsing Cookies" -nobanner
      4⤵
      PID:9020
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin""
  2⤵
  PID:8936
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin" /E /G Admin:F /C
    3⤵
    PID:8956
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\000000A7.bin"
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "000000A7.bin" -nobanner
    3⤵
    PID:6064
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "000000A7.bin" -nobanner
      4⤵
      PID:5408
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001""
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001"
    3⤵
    PID:8848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:9828
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:10120
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001""
  2⤵
  PID:5932
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:5852
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001"
    3⤵
    PID:5836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:7308
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:9036
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons""
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons" /E /G Admin:F /C
    3⤵
    PID:5880
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons"
    3⤵
    - Modifies file permissions
    PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Favicons" -nobanner
    3⤵
    PID:2664
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Favicons" -nobanner
      4⤵
      PID:9964
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index""
  2⤵
  PID:9880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index" /E /G Admin:F /C
    3⤵
    PID:6168
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index"
    3⤵
    PID:10040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner
    3⤵
    PID:9164
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "index" -nobanner
      4⤵
      PID:7484
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data""
  2⤵
  PID:8780
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" /E /G Admin:F /C
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data"
    3⤵
    PID:7612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Login Data" -nobanner
    3⤵
    PID:3172
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Login Data" -nobanner
      4⤵
      PID:2932
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1""
  2⤵
  PID:8804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1" /E /G Admin:F /C
    3⤵
    PID:7588
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1"
    3⤵
    PID:7472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner
    3⤵
    PID:8912
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_1" -nobanner
      4⤵
      PID:5312
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2""
  2⤵
  PID:8776
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2" /E /G Admin:F /C
    3⤵
    PID:7460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2"
    3⤵
    PID:8788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_2" -nobanner
    3⤵
    PID:5264
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_2" -nobanner
      4⤵
      PID:6456
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:10028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0""
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0" /E /G Admin:F /C
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0"
    3⤵
    PID:7252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner
    3⤵
    PID:9144
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_0" -nobanner
      4⤵
      PID:10020
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui""
  2⤵
  PID:292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:6684
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:8564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:8268
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:7092
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL""
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL" /E /G Admin:F /C
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL"
    3⤵
    PID:8628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Reporting and NEL" -nobanner
    3⤵
    PID:1972
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Reporting and NEL" -nobanner
      4⤵
      PID:7696
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui""
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui"
    3⤵
    PID:7208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:6448
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:6564
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:1352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui""
  2⤵
  PID:7532
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui"
    3⤵
    PID:8708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:5340
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:7264
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui""
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:8476
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:8560
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui""
  2⤵
  PID:8572
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:8256
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:8752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:8436
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:8704
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui""
  2⤵
  PID:8692
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui" /E /G Admin:F /C
    3⤵
    PID:8320
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui"
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
    3⤵
    PID:7440
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoViewer.dll.mui" -nobanner
      4⤵
      PID:8084
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links""
  2⤵
  PID:8176
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links" /E /G Admin:F /C
    3⤵
    PID:6220
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links"
    3⤵
    PID:5436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Visited Links" -nobanner
    3⤵
    PID:5532
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Visited Links" -nobanner
      4⤵
      PID:7260
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl""
  2⤵
  PID:6320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl" /E /G Admin:F /C
    3⤵
    PID:7644
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl"
    3⤵
    PID:7708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl" -nobanner
    3⤵
    PID:6240
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MoUsoCoreWorker.813b6a75-c2c4-4376-a282-0633011d435c.1.etl" -nobanner
      4⤵
      PID:6224
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl""
  2⤵
  PID:7352
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl" /E /G Admin:F /C
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl"
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl" -nobanner
    3⤵
    PID:2352
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "UpdateSessionOrchestration.b1baf8d4-db41-4e65-8376-75482583cb6a.1.etl" -nobanner
      4⤵
      PID:7368
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0""
  2⤵
  PID:6196
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0" /E /G Admin:F /C
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0"
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner
    3⤵
    PID:9552
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_0" -nobanner
      4⤵
      PID:9808
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1""
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1" /E /G Admin:F /C
    3⤵
    PID:9520
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1"
    3⤵
    PID:6384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_1" -nobanner
    3⤵
    PID:7448
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_1" -nobanner
      4⤵
      PID:7536
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""
  2⤵
  PID:10092
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C
    3⤵
    PID:7712
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"
    3⤵
    PID:7688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "wab.exe" -nobanner
    3⤵
    PID:9716
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "wab.exe" -nobanner
      4⤵
      PID:7792
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui""
  2⤵
  PID:7868
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui" /E /G Admin:F /C
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui"
    3⤵
    PID:9264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
    3⤵
    PID:7700
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "ImagingDevices.exe.mui" -nobanner
      4⤵
      PID:5488
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui""
  2⤵
  PID:7328
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui" /E /G Admin:F /C
    3⤵
    PID:7860
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui"
    3⤵
    - Modifies file permissions
    PID:9184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
    3⤵
    PID:6944
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "PhotoAcq.dll.mui" -nobanner
      4⤵
      PID:9104
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin""
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin" /E /G Admin:F /C
    3⤵
    PID:228
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin"
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000004.bin" -nobanner
    3⤵
    PID:2044
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000004.bin" -nobanner
      4⤵
      PID:9132
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin""
  2⤵
  PID:752
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin" /E /G Admin:F /C
    3⤵
    PID:6376
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin"
    3⤵
    PID:7072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000F.bin" -nobanner
    3⤵
    PID:244
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000F.bin" -nobanner
      4⤵
      PID:5984
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin""
  2⤵
  PID:9524
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin" /E /G Admin:F /C
    3⤵
    PID:8896
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin"
    3⤵
    PID:7496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000O.bin" -nobanner
    3⤵
    PID:9856
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000O.bin" -nobanner
      4⤵
      PID:6016
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin""
  2⤵
  PID:9796
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin" /E /G Admin:F /C
    3⤵
    PID:7672
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin"
    3⤵
    PID:9500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000010.bin" -nobanner
    3⤵
    PID:7660
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000010.bin" -nobanner
      4⤵
      PID:8360
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin""
  2⤵
  PID:9948
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin" /E /G Admin:F /C
    3⤵
    PID:8344
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin"
    3⤵
    PID:9340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000018.bin" -nobanner
    3⤵
    PID:9564
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000018.bin" -nobanner
      4⤵
      PID:9460
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin""
  2⤵
  PID:9472
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin" /E /G Admin:F /C
    3⤵
    PID:6496
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin"
    3⤵
    PID:8048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000050.bin" -nobanner
    3⤵
    PID:9660
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000050.bin" -nobanner
      4⤵
      PID:9768
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin""
  2⤵
  PID:5240
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin" /E /G Admin:F /C
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000058.bin" -nobanner
    3⤵
    PID:6812
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000058.bin" -nobanner
      4⤵
      PID:6652
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3""
  2⤵
  PID:6960
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3" /E /G Admin:F /C
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3"
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_3" -nobanner
    3⤵
    PID:9608
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_3" -nobanner
      4⤵
      PID:6968
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001""
  2⤵
  PID:6516
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001"
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:6796
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:2420
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3""
  2⤵
  PID:6908
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3" /E /G Admin:F /C
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3"
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_3" -nobanner
    3⤵
    PID:4772
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_3" -nobanner
      4⤵
      PID:828
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index""
  2⤵
  PID:748
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index" /E /G Admin:F /C
    3⤵
    PID:6912
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\index"
    3⤵
    PID:4424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "index" -nobanner
    3⤵
    PID:536
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "index" -nobanner
      4⤵
      PID:4504
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"
    3⤵
    - Modifies file permissions
    PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "KnownGameList.bin" -nobanner
    3⤵
    PID:2468
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "KnownGameList.bin" -nobanner
      4⤵
      PID:1000
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin""
  2⤵
  PID:5536
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin" /E /G Admin:F /C
    3⤵
    PID:9588
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000070.bin"
    3⤵
    - Modifies file permissions
    PID:9408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000070.bin" -nobanner
    3⤵
    PID:7048
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000070.bin" -nobanner
      4⤵
      PID:7112
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin""
  2⤵
  PID:9324
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin" /E /G Admin:F /C
    3⤵
    PID:6364
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000078.bin"
    3⤵
    PID:7256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000078.bin" -nobanner
    3⤵
    PID:9320
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000078.bin" -nobanner
      4⤵
      PID:9240
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin""
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin" /E /G Admin:F /C
    3⤵
    PID:9020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007G.bin"
    3⤵
    PID:8928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007G.bin" -nobanner
    3⤵
    PID:1808
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007G.bin" -nobanner
      4⤵
      PID:5992
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin""
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin" /E /G Admin:F /C
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007O.bin"
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007O.bin" -nobanner
    3⤵
    PID:6472
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007O.bin" -nobanner
      4⤵
      PID:8108
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin""
  2⤵
  PID:8792
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin" /E /G Admin:F /C
    3⤵
    PID:6596
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008H.bin"
    3⤵
    PID:10140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008H.bin" -nobanner
    3⤵
    PID:10120
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000008H.bin" -nobanner
      4⤵
      PID:8960
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:10192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin""
  2⤵
  PID:6480
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin" /E /G Admin:F /C
    3⤵
    PID:10152
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000093.bin"
    3⤵
    PID:10224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000093.bin" -nobanner
    3⤵
    PID:5996
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000093.bin" -nobanner
      4⤵
      PID:5596
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:10228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl""
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl" /E /G Admin:F /C
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl"
    3⤵
    PID:7444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl" -nobanner
    3⤵
    PID:10128
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MoUsoCoreWorker.cb8d9006-5088-40ac-aec7-14e437feb25a.1.etl" -nobanner
      4⤵
      PID:8040
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\ProgramData\USOShared\Logs\System\WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl""
  2⤵
  PID:7508
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\ProgramData\USOShared\Logs\System\WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl" /E /G Admin:F /C
    3⤵
    PID:10048
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\ProgramData\USOShared\Logs\System\WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl"
    3⤵
    PID:6948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl" -nobanner
    3⤵
    PID:8068
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "WuProvider.765030d1-5b68-4381-8718-5d59c84eab74.1.etl" -nobanner
      4⤵
      PID:7000
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0""
  2⤵
  PID:9172
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0" /E /G Admin:F /C
    3⤵
    PID:8828
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0"
    3⤵
    - Modifies file permissions
    PID:7620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner
    3⤵
    PID:3180
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_0" -nobanner
      4⤵
      PID:1340
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin""
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin" /E /G Admin:F /C
    3⤵
    PID:9200
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin"
    3⤵
    PID:9944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000006.bin" -nobanner
    3⤵
    PID:3852
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000006.bin" -nobanner
      4⤵
      PID:8064
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin""
  2⤵
  PID:7340
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin" /E /G Admin:F /C
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin"
    3⤵
    - Modifies file permissions
    PID:5568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000H.bin" -nobanner
    3⤵
    PID:5284
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000H.bin" -nobanner
      4⤵
      PID:7616
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin""
  2⤵
  PID:5308
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin" /E /G Admin:F /C
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin"
    3⤵
    - Modifies file permissions
    PID:9896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000Q.bin" -nobanner
    3⤵
    PID:2312
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000Q.bin" -nobanner
      4⤵
      PID:10028
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin""
  2⤵
  PID:8840
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin" /E /G Admin:F /C
    3⤵
    PID:9080
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin"
    3⤵
    PID:10020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000012.bin" -nobanner
    3⤵
    PID:8240
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000012.bin" -nobanner
      4⤵
      PID:284
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin""
  2⤵
  PID:280
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin" /E /G Admin:F /C
    3⤵
    PID:6756
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin"
    3⤵
    PID:8328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000052.bin" -nobanner
    3⤵
    PID:5916
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000052.bin" -nobanner
      4⤵
      PID:2392
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin""
  2⤵
  PID:8216
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin" /E /G Admin:F /C
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000072.bin"
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000072.bin" -nobanner
    3⤵
    PID:6872
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000072.bin" -nobanner
      4⤵
      PID:8760
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin""
  2⤵
  PID:9316
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin" /E /G Admin:F /C
    3⤵
    PID:7420
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007A.bin"
    3⤵
    - Modifies file permissions
    PID:684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007A.bin" -nobanner
    3⤵
    PID:6564
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007A.bin" -nobanner
      4⤵
      PID:8636
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin""
  2⤵
  PID:5868
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin" /E /G Admin:F /C
    3⤵
    PID:6976
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007I.bin"
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007I.bin" -nobanner
    3⤵
    PID:8180
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007I.bin" -nobanner
      4⤵
      PID:5872
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin""
  2⤵
  PID:8560
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin" /E /G Admin:F /C
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007Q.bin"
    3⤵
    PID:8596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007Q.bin" -nobanner
    3⤵
    PID:8656
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007Q.bin" -nobanner
      4⤵
      PID:2996
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3""
  2⤵
  PID:8688
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3" /E /G Admin:F /C
    3⤵
    PID:6696
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3"
    3⤵
    PID:7808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_3" -nobanner
    3⤵
    PID:8544
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_3" -nobanner
      4⤵
      PID:6856
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001""
  2⤵
  PID:5172
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001" /E /G Admin:F /C
    3⤵
    PID:7764
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001"
    3⤵
    PID:7436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
    3⤵
    PID:6548
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "MANIFEST-000001" -nobanner
      4⤵
      PID:5792
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360426561241360""
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360426561241360" /E /G Admin:F /C
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360426561241360"
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Session_13360426561241360" -nobanner
    3⤵
    PID:5092
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Session_13360426561241360" -nobanner
      4⤵
      PID:4452
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin""
  2⤵
  PID:6348
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin" /E /G Admin:F /C
    3⤵
    PID:7720
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008J.bin"
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008J.bin" -nobanner
    3⤵
    PID:3752
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000008J.bin" -nobanner
      4⤵
      PID:8172
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:6556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data""
  2⤵
  PID:6424
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" /E /G Admin:F /C
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data"
    3⤵
    - Modifies file permissions
    PID:9520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "Web Data" -nobanner
    3⤵
    PID:6384
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "Web Data" -nobanner
      4⤵
      PID:7240
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:7536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin""
  2⤵
  PID:8168
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin" /E /G Admin:F /C
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000095.bin"
    3⤵
    PID:7676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000095.bin" -nobanner
    3⤵
    PID:7008
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000095.bin" -nobanner
      4⤵
      PID:6392
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0""
  2⤵
  PID:9748
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0" /E /G Admin:F /C
    3⤵
    PID:7408
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0"
    3⤵
    - Modifies file permissions
    PID:6680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "data_0" -nobanner
    3⤵
    PID:6792
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "data_0" -nobanner
      4⤵
      PID:7564
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin""
  2⤵
  PID:7816
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin" /E /G Admin:F /C
    3⤵
    PID:9820
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000009M.bin"
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000009M.bin" -nobanner
    3⤵
    PID:7312
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000009M.bin" -nobanner
      4⤵
      PID:7860
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat""
  2⤵
  PID:9104
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\settings.dat"
    3⤵
    - Modifies file permissions
    PID:7972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "settings.dat" -nobanner
    3⤵
    PID:8952
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "settings.dat" -nobanner
      4⤵
      PID:9168
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin""
  2⤵
  PID:6832
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin" /E /G Admin:F /C
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin"
    3⤵
    - Modifies file permissions
    PID:6800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000C.bin" -nobanner
    3⤵
    PID:9284
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000C.bin" -nobanner
      4⤵
      PID:2576
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin""
  2⤵
  PID:6992
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin" /E /G Admin:F /C
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin"
    3⤵
    PID:5800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000M.bin" -nobanner
    3⤵
    PID:7724
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000M.bin" -nobanner
      4⤵
      PID:6572
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin""
  2⤵
  PID:9352
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin" /E /G Admin:F /C
    3⤵
    PID:9504
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin"
    3⤵
    PID:8736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000000U.bin" -nobanner
    3⤵
    PID:5376
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000000U.bin" -nobanner
      4⤵
      PID:7640
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:8360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin""
  2⤵
  PID:5668
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin" /E /G Admin:F /C
    3⤵
    PID:9468
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin"
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000016.bin" -nobanner
    3⤵
    PID:9576
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000016.bin" -nobanner
      4⤵
      PID:7384
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin""
  2⤵
  PID:9476
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin" /E /G Admin:F /C
    3⤵
    PID:8212
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin"
    3⤵
    PID:7424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000056.bin" -nobanner
    3⤵
    PID:8244
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000056.bin" -nobanner
      4⤵
      PID:5772
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin""
  2⤵
  PID:9596
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin" /E /G Admin:F /C
    3⤵
    PID:9732
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000006U.bin"
    3⤵
    PID:5504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000006U.bin" -nobanner
    3⤵
    PID:5168
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000006U.bin" -nobanner
      4⤵
      PID:2920
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin""
  2⤵
  PID:9616
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin" /E /G Admin:F /C
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000076.bin"
    3⤵
    - Modifies file permissions
    PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "00000076.bin" -nobanner
    3⤵
    PID:7380
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "00000076.bin" -nobanner
      4⤵
      PID:7176
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin""
  2⤵
  PID:7116
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin" /E /G Admin:F /C
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007E.bin"
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007E.bin" -nobanner
    3⤵
    PID:4260
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007E.bin" -nobanner
      4⤵
      PID:2420
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin""
  2⤵
  PID:7136
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin" /E /G Admin:F /C
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000007M.bin"
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000007M.bin" -nobanner
    3⤵
    PID:9436
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000007M.bin" -nobanner
      4⤵
      PID:828
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:9580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin""
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin" /E /G Admin:F /C
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin"
    3⤵
    PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c LTak7xej.exe -accepteula "0000008F.bin" -nobanner
    3⤵
    PID:2432
  - - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
      LTak7xej.exe -accepteula "0000008F.bin" -nobanner
      4⤵
      PID:1880
- - C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\LTak7xej.exe
    LTak7xej.exe -accepteula -c Run -y -p extract -nobanner
    3⤵
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\Bh6CS2zQ.bat" "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin""
  2⤵
  PID:6568
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin" /E /G Admin:F /C
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008N.bin"
    3⤵
    - Modifies file permissions
    PID:4416

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\8qCyH3KW.bat"
1⤵
PID:7796
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:6672
- C:\Windows\System32\Wbem\WMIC.exe
  wmic SHADOWCOPY DELETE
  2⤵
  PID:5472
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5692
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6872
- C:\Windows\system32\schtasks.exe
  SCHTASKS /Delete /TN DSHCA /F
  2⤵
  PID:7696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcb7b9ab58,0x7ffcb7b9ab68,0x7ffcb7b9ab78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AB89_INFO.rtf

Filesize
7KB

MD5
d0aa0b76d03e9a5bab5de299c21810e0

SHA1
2f68e9920e4fc8ec6057b23680f93e3a0bca3ecf

SHA256
e8d1873a1a7dc75c19d3d74d92eaddd1fde8cae89040554c18f07edad7a59a74

SHA512
99b7ca7a8b5f843dc046da237eb6b92307c8899dff62c02469cf17a40fc4657e9253199fab46a6ac3eae64e8325b24432f5980fff0f2c69db1b7b599d3415b0b

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
65KB

MD5
57de7c281b72bf0b9b90032e11951b34

SHA1
e54568d551cbefdbcb34ad5a2c69e7e3228d600e

SHA256
3d8093c88ec8fde808539ca7bb86ea623ed0ae54b31977febb94880f380d4e6a

SHA512
d23e7d53d2877dfdc5ff8b0d4a6d046ce76fc000f126a0fe16bd663b48247793470fd7f89822f68f09c88425b2d23a82faf68166aac4f01de5ff3ab3cdb1d6d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\15e0d206-2725-431e-aee1-ce595be79afa.tmp

Filesize
129KB

MD5
8f1c33236ec3df12e4e8f455ed8cf90a

SHA1
b49f0fa5275b60135afa6c73219de9de67941ed1

SHA256
800becbc94a7be77a83c9e393657799b38a688869085f453d1d1c71f71fdc76a

SHA512
e5945cce049e57d19d1df049f8ac222adc451f84a0163ee78aaa0a829f95737634fb196bece3dd31913e919d059fdac6913271bbd5afa010cc416a88258534db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\f79162d2-2e36-4790-8193-d5315524a088.dmp

Filesize
386KB

MD5
bf3d80fb2d79cf4cabec8597f0a73d2b

SHA1
ba6f23247b69743cb1ba2debd2753a3d68d121be

SHA256
28792cd64eaf0f46de322da4cbaa1e2d56ae9350470b935fa28d57351223fcd8

SHA512
2da309d245267b54ca40f5b89a0b2b340f2dee071c5cc0587e983bdb92a945f72009f98b1a3c3ad86f105f8227d5f144097fb2dbdfc0f7c7aa5d384d5eb0f639

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\fc95a02a-cd42-4122-b549-7d7a557103a2.dmp

Filesize
99KB

MD5
9f9915904acf53d1d7fb0259259286d1

SHA1
8dd284eeba6c540fb7cc6880efddb22b9aacee9f

SHA256
29720e2837bb97805207f99187c6bfc4747f4d7df0eeab4249bc75c154d68257

SHA512
d758824233d8bcb83fbd0916b932a5a161c03f3f403cf4cf6e7acc2c34f58502303f75cf7f55b48db0ed19fc95eb5aecfee1983c97c9d9d64f12d1ba02be3918

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\ff9c0541-8047-4071-b648-89120405603b.dmp

Filesize
99KB

MD5
292b3e022102db1380304a5e2df3194e

SHA1
3287ab41e92b99a3af697eda2c48f63255711a43

SHA256
9c4b8f1fadd55e8bc00609e90564983c31dcc4814c88fd56a589ccb4559dd6b1

SHA512
54c5d3615df4f3033922155a0876ebc30bef0d8024f9c2741896cea32e0ded6aaaa90c84a0eefca2b505d4b2a1312ba48a6057db4a7e7da68d7e854615e33bd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
1KB

MD5
0558835589d5a5da88bfd5d3c3ca2192

SHA1
a52acc0d26f6e96ee966e6fcbb25ff7cc4c80bfd

SHA256
59f395c942d3aac35f0f0b7ec45a19be6d7b536a06b3376ceffb34cbdf906f4d

SHA512
2cd2e700588de275512048f149db95dadf1b89f7d6532206e5115f6794a95901687a3e9148658368adb5ceec88c73d5cfdacff55133065632cdeee5b9accb9bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
d113f73ecb1df97887a68f868cd99bd9

SHA1
ed792acb46a749f9713c2b442fa585360e2760ff

SHA256
fdc71d09f3b7a897d474a28888aca6dd7884d2ee42f956004ca2435018038997

SHA512
0d4dd7f3da7eda0f74951d8112a07183d8f4736f44f6bc12b833c5238403e7c4a0c490a76fc4cd772fbedb6600b4f5dcb7c2883467ff5ee671e0a1ad38ef7e18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
75KB

MD5
547617f91b256cae0735efa046412a27

SHA1
1967741ebad8f0e0c153831b62e009347ae78d79

SHA256
40a35337b6b1045772cbab881951e82ff10d1a7c9191ba9ffdec7d55e939bd09

SHA512
4042cf05a21531e59220cd4192b74a5cd7d3ec8f1a5778965a44ba4dcb1b0ad97984c1fc02b1305eb7453ca12d108df6aae488520b20c6843b7e8e5b29ea19f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
25KB

MD5
d05c3d6ee23b936705bf73a0bf3aa7d2

SHA1
bfdd66c5f500d9a0ab89425e388af2ad12b78007

SHA256
2bcddc06401233520c30e79e946a625fdfefe20db52c96dc66759920d36bbe10

SHA512
504e1936d51a134d80ee4248850c1b95b2252ffaa712771f051691c2be1f70b574ff123f1bc72ab41df8e4a7867a52dac547f0db51e408097f043bad40bd6139

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
77KB

MD5
0b814b2000540de0c33e848e83b82096

SHA1
c1c0824f3ccd162cf0d265e2522c0e94ed0bc010

SHA256
f3d0a94e2d61fce93e775fc25648baad461b039ca0fb488aede368877c08e4d4

SHA512
06d62237d260a1bcd823c47b0cabc4eed9b56d8e0ed300fb3c78041076fe4078b45641f14e04971c6a82766f48f9b449415160e179c3264fb8fcd186ce075cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
142KB

MD5
a9674d3a0dc07fc2e46fc830214ffdfd

SHA1
c2dda7dfe161dd7580c10b3c23e6df073dcb676a

SHA256
b65a26ae555407515cc289d694e27e73e45e2bb1097acbff273f47060f25ab7e

SHA512
78c98542197a9f7134eb7fe0b75276c04565e7265c85fd00e9e069f510cd6f9ddd8520c10ed33fc6ddab444be453eb493e2718a26a593b5a1475ca5ec9e46511

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
45KB

MD5
3f9aad2c45cf47dd2933baaae99629b6

SHA1
4752ae37bbd2c39b67d2c84693c0d87943a6f031

SHA256
67585fcbfcbb8368cf9c84cc445bbd9f3df571e23707b2d511bd09ed37ebd261

SHA512
3bbad03a6b333e3949e7086cad11b601e3cdbc23a5856766c22dc108f60f944752f016dbd982711074a25982bad6140fb0706cde5e900aa74d0197e3b9de1ef5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
45KB

MD5
3ee0fca0f46bcfbe36eea433b1656100

SHA1
fe782bb5417089a2c3b2e1378fbe5a7c7889bac9

SHA256
8de40b8725f287fb4b58485f1dd73d418abfada2e9ea7f8c0081aa60f5edfa4b

SHA512
da6ff5ce866c050c09037ab7ee6c2450ea135e885918a5589528b9eff8128eb667df0d04fc5869a68e946587017378d314763cff8c7101a7683683ca6f13e93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
23KB

MD5
3d0f0820516efbe60a761f23cf6618d2

SHA1
2bb96f655e9e065dc594ba58dfc7ec1923d28346

SHA256
aedbf3fccecf676204df8668da5fe773b86237c1c481904695cc8be66482b217

SHA512
30169e9b2fca889261bb8cf8b42ebabab88c876af816f2e6550f01fcb4a9d122866c9f8d59183da93e2b44b0458f75a3f58df525d41bbefdb459bbe091de9681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
154KB

MD5
34be0a62136aa56a40cc008333cce6d9

SHA1
ff1a523bc004b7298d45938867cf71bb0ae6f82b

SHA256
f1981af216003992e6b9a5fd1da77ceddb94fdefcfeb0f0eacc8e4596be161a1

SHA512
f196abd094409fe1cfa924e023bc84d921cc48afe962b0dd3e5d808b6d588d64e5af329740b5064c6fcac0c53779b433019af2eb33a0af0e2c73b5229aaadacb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
31KB

MD5
35d3f58c6a0423b5df9130f1484777bc

SHA1
8d02be67b458a8c07d6af06b7bca19deb7038e22

SHA256
3d9b981a20c06de1c35bc8dadeeb1c979f4a075dee3c2e70ef2117f070af7a28

SHA512
ab5ff1500ff394a532ffa0a75c1b0413842a41dae8ae7c47b51d07f83aea70f5e4ff2d80c76c9c2d66448df5cfe98d3a9a523066de29f5089584e54405ec358a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
22KB

MD5
62526d2210116a118bd5607c4f51db85

SHA1
899bd84de9cd6fc71cc5c3b943ebe3562760d8ea

SHA256
86c03b6b8e1f61bb0d3fcb7e90e90657abfbe7a93f4bbd714c0514d1d966499a

SHA512
ab3a7b863dcb6c657f86e01c050dff15d37b30767825457dec9e3a49f92f0436b5ac9604f4d3491945d62dcad0db65e95d9af6907af3c7cdb82846bf65eeee5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

Filesize
90KB

MD5
4bcb20d4e8d6df6bd938267e368b4a40

SHA1
4f809cdb14c58b13f8aed3689bdcf915c46b835a

SHA256
8ef028eb6c61d1b219bc1ca9e4639a3a12d0bca4924bf8fc5991d47532ca61c2

SHA512
ba386fb741a6e47f152b6f6190593e27b2d8fd1b066f841528134fa0074920bad8b6f4d753228db5c29da53d95a7fb5757a07281ff69bbc64428cfcfec3f7ea9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
6.3MB

MD5
7b46f07187f351027185cd1277141d87

SHA1
1bc43f607774969aa463602991da3c2bbf426819

SHA256
7c9dfbcaee10c98e3c56978c7229a78cbd8222ff1a0908784e9dd8a17fdbbe16

SHA512
c123ae2c355a25147ea4f809fc302e52adc622de2cef03a83693b3ca514453bf3608b9883ae80b9cbd1bb73466a3412083a6672c0937dba2aace22a90fb438e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\051dc6dff085a714_0

Filesize
23KB

MD5
cde9be0450c2cde605be9374c4b18b3f

SHA1
be84959ed44c734023fb1881d4f5bc825b4b74bb

SHA256
2647537c3a02996d292698a9cf91a9c2c2190cf7164cf4af136023f4eda55fa3

SHA512
6740f0fc72ca3e58a6d16c46305c8735b3b8696dcfaa444887e303d2098f587f488bd5cef9a5aafba295679d0130a7f804f150650f0732c6a47d3688ecb9a361

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\05e8013d0ebf56a5_0

Filesize
1KB

MD5
8a60b379a4a235657055b63424e7bff5

SHA1
c9e41ff7d604d25037a505164cd3596bb9bfabaa

SHA256
bfd126a22ccf25c6e89690d81ec7391123068f2ef3c67358237c5b5df3a44c28

SHA512
b66d092481e87968781c341a7ce9f76755863943a3aefe1d8b062501e70219d2a2cf7c324d056e8c78a9e4f7bb6b549e430d951bc0a839c5fe2c5ffd1cda68be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\08e1864847f62df6_0

Filesize
1KB

MD5
f128c65bec52ddba8be8cb0f0f266452

SHA1
090ebee4aa8d1a89a2efc475264c410310f083f9

SHA256
d77010d601fd99d29aaf77c3008e04949ea7777ac51b2cf22993f5b5b35c3159

SHA512
7733fd6ab16085e448db8171ef0a0a762bab4cdedcf04d492540cd543dd298c69621f0f9ef446f1dd8e999598907f4976bb36ac6f32350f95bbddf38d7669ab3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0cac38a50a5fa198_0

Filesize
5KB

MD5
55bca597305d579a40d210c8ca75fa63

SHA1
9d3d51dbd4dfac91aa578f51c31544da33f2e86a

SHA256
77333710823111f778626bb69830eb69389d41fbeddece6a2261ba623033eea0

SHA512
fe0e8b755d3446237496a27e5426a23065fb546657f1159419083ddb61cfc188a3a4163465c1f09d6a3f3785274907e77bac2ee2236e7e828f6a2ee117fc54ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1203f2718d021678_0

Filesize
1KB

MD5
a9bbf91be1a6fb417a6e134980d57ce4

SHA1
67fdf4053555f99dcb2777054a42c57ce22ffad4

SHA256
6609ed62a25f87f8b262b4deb051a3f6f8d090cfcc144161f87cd48b390f71b9

SHA512
4bc24a20d789c33b86a4eff7ede674cf4f5294b4b556fec8681646245c7575d680cbe65bd65d049bda5233fdccf2744e02e359bd6f674e58ef438fe5c22545e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1ddefb550a28cc70_0

Filesize
1KB

MD5
7f1f0c79ffdeb7e8ec536fa15ae9324c

SHA1
505f496a805389740d8f5a23ec4c493ecd588364

SHA256
d891a2c53e98d040189bc38faad83525709386f8e8160551c2bb67b2439c5a89

SHA512
85b5bc8faed850da467301993171cac5c65b3fe68651406d7e9fb70002b56e5384441f1ec4bf3e2c1b2a3b967f2524689d4f1798c08592bb20cb4e51b396a038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\22bd894e0efdfa4e_0

Filesize
3KB

MD5
eaadea7015d4e5005ecbc53f60bb79df

SHA1
33a6887e346e6d718f3854470644711fdb5b1281

SHA256
deada15c42f24bfd0788b18795ed9268e2a2a65379795af7179496869fc2edf5

SHA512
9c77195dc924c4257c99f9e9c2167328e987ff14106ec0b6827a9467416bca0d2d87a63c30cfd059e1f9e2e3ef8da9be81d65d34c0826577a056f1c5ffd0854a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\26dbab8f05a12756_0

Filesize
6KB

MD5
ac2943c37953dcbdf34692a87a1c1b63

SHA1
143e81dfa3d82b29cedff4f69002e5a2a9ec231f

SHA256
b685bb5656a3e97405d15dc42ae61e5d0383e17c740bb87f401479c87fdf7551

SHA512
2b15352d0dcf28fe2e80a8ed75ca6727a9a807532f8fac8bf018b3bdf51427935f2239cd4212fb2cbd33d00c9c4b83560e4dbcec69b93a2b2be1023a8151e46b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2e4bee6b21ffb393_0

Filesize
4KB

MD5
3f3044a628d91304a9761b9cc952d1aa

SHA1
c1947c2f61b5858ac20d31acba18d350cb8d105b

SHA256
649a27d53230696997cbda8ad3e88c0cab117a50d0cfec030c2bf38a06210010

SHA512
bedcfd2247b7f33e707764cf3612f3a06823963a2284a8a309aa3bfaee089229750be704594db7f663b805274b0d944d51124bfabf296676ebe325333070e5f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3c1b71d6c92f4ff2_0

Filesize
4KB

MD5
38a9167f22c9c8bc0e01754258b570e7

SHA1
0aeb87d750faa1e18aaed074c6272e44881e5f57

SHA256
06162f3c3218e1c3d591c58e43151add4bf1b8f95aead7301dbd64dc46cf1bc9

SHA512
20fc9d4387e425ec5467e15c9d6907b687945659629436e5955cacfc730da24e3a6f5e9f59c342dff01160fec99230ffcc532b483cc8060f343a9cded4cf7113

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3cc4dba5302f05ac_0

Filesize
1KB

MD5
699a49762e3a68eaa13b515d0b996cfd

SHA1
a4d027b27cf6e9c339dd13d15d977288127d4d7d

SHA256
1eeb706d3f8b45777b96e84da7d0cfeea2b686273a955d18b5c1b848b9478d7b

SHA512
7c617c5dfe16d5b8087fbd9668717e305f0df7610132d567bcd318bcce1496872ad28b9a78a1cff0d43c340ec22ef8976f03a2164962b77ae1da8139f28663a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\407fee1fd509a0f7_0

Filesize
26KB

MD5
38141e98b4d57edf7a362d1403b66a52

SHA1
be8d7532a8c97c2c98fefee7ed2c8c0a6fe30e43

SHA256
28dad34956dcadc1c1ae09e3d38ae47ae70cedd9faa74a5fbe355f02c9ae3f51

SHA512
bb80a0a49d03e2cc7fc7f01ee02c04c3bc648795cbc995da82c3247f0d1a2a220c2d396e3529980e7dd23f08b36f58c19f11c68e18150af2a81ee7e1fc1fa359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\499b86fca3b4305a_0

Filesize
5KB

MD5
f8d1fb57833194366ccfc8a6fac0b05e

SHA1
cf6060619eac49890c77f7b0cd8a13fa8672f267

SHA256
523df267af566892b00067ae7b11960fa7bca19ebd777174379459b1d1c81bff

SHA512
0ec306b9a158e55e59489a39e5fd0c0f9898fe33dff94b9b4d26ea5abed7e4cce7c2c5a814d40434e0b89c87f96d37cbed042baf25f45cab2001b1498b1fedf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\49f34b36bfa22239_0

Filesize
3KB

MD5
345ee5b0ef93d15d7684397090e16f3e

SHA1
22f329e9cec2e883520563834f82cf9cc94d91a5

SHA256
cf87e05b8aecd3ade2737e209e1b26c4364a63f037ffe0de7dc7360d12547b1c

SHA512
8df05ce63e3c887ee6d2098986a1d7154bfc29bc6f4e484158cf3849b39ad5be10dbc52b69d248f207eec21343ed8924307eb0dbf63cdc85e05c8f50a02b7920

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5e4a3687c717d38f_0

Filesize
2KB

MD5
d5291be15a074b9a78788f6474526727

SHA1
96bc3636321bb5d2e142db21d69b2d99909e17ef

SHA256
ca38e7e53bf4a144197eae8a014c4385996c45dd07b140cb7407740edb35b660

SHA512
49016fd1b72bac91b960ff95589e21ba9aa42cdab4c43c3b4033beae22d1b5d5cc0a1ff2970bde3fdf471daab0539b3b55906af0a48890844a5375a3cd6a5656

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5e684f4faacdcf05_0

Filesize
24KB

MD5
a769db6485b17a1863db5d6699ff3b33

SHA1
4c8b7468ed78d3438ef82f17153e0aaafbec08a7

SHA256
2339348669c2080b17377bd972307bfe49aad9ab70b9a6f20699e079172545d3

SHA512
4b5338d0c1f3f75c09a11fce47545da646a3c0c13ef1a5311d2f807b89fcce64753a77b5959dc7f0c5966631770887c5f553687da63e0d0e44e4c18b6d2c551b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\72022362786480fa_0

Filesize
5KB

MD5
e59cd58f16b908385e0bc8fb8872d0a9

SHA1
b91cb7101ed57d0c79d6f59c788014dc51e44085

SHA256
6b55a188ff4640eea44938ec99c1c866bcc93b52cb5cf322a9ba11219f9da56b

SHA512
d2ebbd616b1850b0c6adb7bd3ce613b3df9397d0861cd1a2d0ba5a86e1f8c85ce717708f3b062e018600304090693850b37f4ad94e496c56126d7a14d35ea3a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\76e0e1a44020cbea_0

Filesize
1KB

MD5
32c5455f2af0cd8093543a0243aa818d

SHA1
d4da2438537c61ce25e9661f4675ad698786ff95

SHA256
b8da9313bd7ba686fca5a71bc400f5847ea33da772e21950f231f35bdca804e8

SHA512
a7347112f5ae1dcbcf74d96b2b9e963e36fc3316482bcedeb34ad8ed59c2ac6c66216d606f37df9f5c1a11796ccbe12c8a348128743047085a2f11bb9df695da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\81fd0f9bad97b2cb_0

Filesize
1KB

MD5
035439fe6755cce5dc6d668f58cd71a0

SHA1
8aa36e6e9232cb85b6a03b51f5afc1ba7b8000fd

SHA256
1c4200afc20836c66a9151bc18239d6b948e2147d9d6ee85d5e97bac85685a31

SHA512
ac0f1f406ed32c1935b483eaaa69ba26f4d969fa1536cd772c18760c4e64dd718f924f9fcf0219adb013ed93fcaed758de412175feb0d517ec47a113f19bd1ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\842a56e5adf1ff8b_0

Filesize
1KB

MD5
9b35c54d2964e11bc3b4bca5a927e44d

SHA1
1c994f7c513fb407035e8796901a08114de4c4e8

SHA256
d50f63531ac7f5581b9476b98bab4374e64a6d4d6545dc1ecefa3d84863e78d5

SHA512
cb7d3dd9f70b3548ea8b6b80501d6fc1c0da30b77724343b26da3cac7c67bae0cd1b02787f021ec078b37ba339b838f23fa9f1102e6c455d94dd2b11f933edab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8d87807087366e25_0

Filesize
1KB

MD5
80e7496987b0ab86a8eb20c45261ff43

SHA1
92ef25abe3b07f6bf0c757a30fd280bff7967e3d

SHA256
2df384390bae9cd4651f8c593b4fa091e50792c77c86ef79d499750d561e7c5f

SHA512
319c8783506227c52b0ea7d947aff93fdd7d81d53649c1175a45ecb197b951e3fe22a70a1b451f5d4986f25960da45c781fc35a50c3b3d5f27354a4632ad53f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\99c86f9cd02ca6a7_0

Filesize
28KB

MD5
8f40c4d0214fa55487897b688ba6f5e9

SHA1
9af92176a686b9b82ef42deea28d0e78fb19e83c

SHA256
b73b6ede326936a1be0b17ebbee6f809e984f934372dabffd3d81da33f11486c

SHA512
e209dd5346016e2f035111ed8a8b0b9f13cdc4682ffef08af4b68e28f47cf4b681febaac3c418f3844b4faaba8743db195bc5c6b22a2c15b2b5d99d2c5cd99c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a50aad6057e22c49_0

Filesize
1KB

MD5
f12734f86629a66bce098862e425a902

SHA1
d07b18fb52324186acce1176116cb08bb73aae7e

SHA256
aa045772fb4633b49bae50641126c8effd553c836b29b971dcc998133933cd4b

SHA512
78771cf19730c08970495f2feb38d6d5c5f393669523c766b2a3fff19793f5204b173b3d61b2590e4e38e142db759627659dddeee91893e4979efa7055f5120a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b422298bd07a207e_0

Filesize
1KB

MD5
f6e4c384681ae838e14872966d0b1d24

SHA1
ebb294a521a56012f22f09a484cb977832811b2f

SHA256
0e90623aa900ed1b990bd243ff2a6955d272c73521bc3914625dca649d1fb0bb

SHA512
40235e77ac40105382b63f664880b8d4476d8c6a1f471746c8d8509564bf4b412719ea4f6cd70f416597ce9c1641e2ecca679a78761289c1e36c19fc637133ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c6f62dc1fb229889_0

Filesize
59KB

MD5
9311b6759abb09057f3419a376d0d269

SHA1
cf38fc306f0173d8bc4497408bbdeb7ac3c28d3c

SHA256
05cbb553cf5cd78f5aa372fee51a2f9fde170be7d8b4bb5a40b0d0c1a27f2163

SHA512
94b0c4955d59faaf4027079abb26f8d406a5e02fa29baa51f0b5754c73f2c901aa626ea3d65938f3ca7f60ae1689f573a5ffc3deb2ee486b385363313e809772

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d157a14c52628975_0

Filesize
1KB

MD5
e672d41cf5ff770b6dbe2496bb291a98

SHA1
cb453772095fabe07041614d6bb64dd9f5033cf1

SHA256
53357bed53f445e42b3db793e1285ee4c1d00879c433eeafc27bb825f0f10fa3

SHA512
ffb06ea1ed3e14b3caf9ccfe8f771d962c4b97d0134a4a3765934313748fcd3a7e026d8df705e72a5ccae6a1451afe52872d9ff98c9e18110ae9348cc24cdd5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\deee4f2116f0d073_0

Filesize
18KB

MD5
11a6196a7c5f0dfbd460d83a635e78e8

SHA1
5d4ae42ed738516ed20dd66b86a3c8b3ecc35ab2

SHA256
9041e8b48165794153d55e1e705fe59f51242f9429e3c9ec31f4b4b3daf9e6e8

SHA512
79c74419e40cd5887011f19b7af59ec411c9e5678e844f1dbc2781ff092b092eb3b04a51b072be7203f453f8a5814f18bb9487ca9f2d6fb2e3ae2150ab8735cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f415a62c226b5305_0

Filesize
1KB

MD5
8919e9ac326cbe46826af13fe19ead70

SHA1
e22f5824a3b77fe78bb4cb027e795d696f444fa2

SHA256
75026ce76602904c0b9db26506041fd961cb8033d945ff9f95a7359536becf7f

SHA512
5430ce586babf67a5cf2ebbda8f188ff6dc12b2ed06d7aa7e79320c189efc57df48b084273071a48fd202a821946a47c06acccb739e92559b01578f728cc965b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c256ded9e5cd8e5f3745aba2610617a2

SHA1
1a745908c1d46d69de82ccac445b014cdbfbaf2d

SHA256
b0b696b36f71e0eab2a3d60554f880be7ddcdd0282f2c59d5b53402d56292fce

SHA512
745d728907ac192a4f35ea059db35080c811357fb00f96cea45cf9ad2f66407244aae5bf03dadd1e984751d824cae1da3eb1881714ddbf51bbb3e8c6b2a6ca5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
95a8ecde88258c6b19e3b365338eb2c6

SHA1
76decd8560779fe6ef6f9501423951ae969c86c4

SHA256
b2ef576e2ade59dc936bab4b0270e06b9573f3641ba4d08f60e5d11a937e282d

SHA512
96a370a399ac96f3ba3360597b1ac6754eb18c9f742f38499183d5a4f232c8fe7f1312fd0c390ab2efb3f5d6e6d86050f4392888d9997b75b9f252811286521f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
23ef53364959654a628b4cee2d2a5e7e

SHA1
ecf0785470a4eb60cd261af8016dd7c490b96e85

SHA256
c5a2f55c20498abcba75d7b2df3f7e7bf78361d124ebf3cf9afd0c58f4a3a04a

SHA512
f87a988e2cd4705e4be68aabcfbc02d173a257d4502e4b66e32df1711b03299ff14d61615d396a5c28cfbb0f506e9338e303976c0c579ada57ad028fa3462626

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e31128fe7b12a0de57164693dac5bd98

SHA1
a23554cdb054c6e08d3871e30b2842705f7b976e

SHA256
bec843b803c419db5bc48ad2b8ef104964be31b7c16050128e119da0cafb8015

SHA512
d56a772254de05381cabd79f877b2736f748804daecfb74b9602a954ac3f1685cd0ced381ae5be321ea61caeb4fce2e1131dd203c5d225517d97ea9d85308b57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
49a4439d66b3a7654266413f7d20098b

SHA1
718f81c4aae893de91fd92784f659d1e307dd89e

SHA256
35b0cd8829364545b2507f1b1a3e7fd5b926d2571e9725bc9ca3f6c542682a9f

SHA512
25ad007bf1dae7c526c12e72e1d9d3c9b7dfb43368ae35ad209e53f6832bce01cf6e19044132ddaa0edc96a609ba69a669ad7b5b5192b59d9d19796db97f0eb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0e25d1de1c3b72dedad2a6f8bfa26445

SHA1
286c67d0fb2e618791059f0291e7996bb981b5fc

SHA256
2d24b4068c0269a2a0a88cde7644527f4e2b689a1c50d992d139e079f9a26109

SHA512
00218aa866506115092d26ac0f17e259d99cd39b818c01905657399b89422a9901dba34747cdcf3f3a780c747502d736f2d10585e705d05e94c60634bce0a779

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b66ca054a75010f948d95ff5c37cba69

SHA1
0e9502e82e9a4f847b9d88a56b3fd6c283d69463

SHA256
3d4f4a8f62f26e1385af380b8246917b2a8dc79c5102f2a8802e4973118338d7

SHA512
406958c1686c8293e94aa39856e4e8b6c43a47c5eca9ad0471291d7a1509819beba32d4ba4a41c4638cb5938c577dd55bddebc1185034165a6cc2917e0e49684

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
d3ae5231b51fbd75e59f2a72c61b3482

SHA1
bb11154cf31353218a5e927b23356a5eb7d9146c

SHA256
1997fdaa0a132513981d0cff7b5e7ef236aa9f5e326d3501cb49b265cab2292e

SHA512
512d0eb3893e7d24492fb7c1735fec783aa5e0ee2859e5305c5647a35d9a1d56aa67559effeea1e5443342dd4a09bbe6fea5ff1ef0a6123acb07e6852e4ea5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State~RFe5b921b.TMP

Filesize
3KB

MD5
ecbfe6469b94de49d502859ef1cfa039

SHA1
6a32026d5477bc60e6b6d7ff0e61dd5fd4c7cfd4

SHA256
4ea4714c768ac94e907f7d62904702963c4e8c2a2bc08dfbe758171076bf0f79

SHA512
03eb80da4739066472c3655753e0396cabe08ded8c4be162ab41f2a68ad86052820792e8ba0ac9229170e8bf1db6aa39c66c227a7baf9a81fe6c2c5bd89abd35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
d5bc4a6fbae88443a17c4ba154991d55

SHA1
3f6bee4f006ac3dd663140b83560c9c3017718e3

SHA256
4f0b3a792f0cd6a2e1dd465d5c85b7a77bab0f1ac7e72fafd5e74a3981300348

SHA512
3a132e3e50e6a271144f086722a3730cbc03925299a182209e53ee065551b5c01331417512c536f3e26a25bcd9b309836504fc6698f1bb8770acbfb01432ba89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a2e48a7e0826633db2658a06ab130cff

SHA1
44a5dbb5197adf9928ddd276e40b6b7655b53a3f

SHA256
944ba3b71fd01e60c27e2c4c8671f567b1460543ab346d257af9185a3753d0aa

SHA512
10511231620f1d66b2eec99a2996832af096af4fee2288ba35ce81af980253532229ae0a0610676a74e3604731ae7eeb8fe0bdfe68b6c337926da77f088ef43d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
75b50a1f4536331d11a42fb8d622e95b

SHA1
c83c3f131f8f63468d96fe409c7b9d9965167169

SHA256
acdcb29a53fc6ea3f4a5018c154fc4a514bf141d4acf6e68c5aa88346b8c5588

SHA512
2c0429c66da9ad053db1b032487461830734e65e0c48e22b7521d95fd02686f1dfd15de0851a2fa29af652fafb84d379477b387645e727b89b9bb7b843ffedd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f9061601f4780cd21d31d55a8c125062

SHA1
b6f76a9f7340b1bbff0f294c8a23ce232feebc9d

SHA256
fd475fc81752556f2694050d6fc2bd739ae557edad7e7f03e68462e829204d9f

SHA512
0732a02daff10a2f18ba4ecef189984c4659bcc08ea0ba4b00336d55991568bf284013122adfef49b655fbd7ba79db5f3f641bf06470a802f57295939a812c08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f75d4e10132036d6e24b322ec7751b96

SHA1
f78b5ec4cb4f4593e189b25bddb5fc47bedf66f3

SHA256
44626201fe962e98bd824992471781fe9765b766a658e30717eb34640fb1db35

SHA512
6be14ded4ebdafa2494985d61df7d0f24ff547a8f2d02bc71c52ae94e07745a939fd7eef6524d0dd6dc2ca65178a56c983683349425e9e942e3d408d0b1978ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
47515a1f0c51afdfba1c0621ac591c79

SHA1
b71cd3e19d9f476b8f953d2c81a9a979b2dafd13

SHA256
38925c215a964882e0dab2b66fd1d4a4eb02a9cf4298a6bfa83045b8edd45516

SHA512
53d8cb24205e4bf18d50d01814795614a8a9e2c060b729497ca5bbaeecaa43c2bc9796d5fb744fb508ada4dc6dd598f2ce5456899f0c5d76643f70c56f08be82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c9fc415f8c685db66c18374f71c8b00f

SHA1
c2ec56e6b1983d5b621698d8eeda2c206be26071

SHA256
2e6d0781a62d76f8a85c858e33950cbc8f829f053d049510fb0ba8ab2c4ce922

SHA512
e9466957eddf846572890ba28b36493c1c4ce28b13a1b8da7a3192c9f48340be99b195d22bc1fb9c580b9a38fdd17017cc950ac00a619d3b53bee75d1baf61fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
82b3d4ae4f5ee947dffbe929b9a517b1

SHA1
4a07dc8a0eb2a610620597d1af387dafe74d2944

SHA256
fd0d6e38bb4de94b99133552b5bd9b1059fbc02cd40f749ea4c8cc730b4274c2

SHA512
b5decf266b7aa764eee32eaa787a8929061f3fd170ab2c79fb79565818f2798fdfec8191c208a2c963c9b98841d66cb12cf48e85049fbb870aeb92a057a15cb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5c6398dcc30044913cec7f2578ba3365

SHA1
428e7b849da29a13cc56e68ee44d9a35a0e34c1b

SHA256
2e9c8543e6b2c33a1a6a3e286b6d91e3b699a78ddf862a1286e34652f9dc369d

SHA512
0c1a7aef74cddd10946bb95e026b35675d5cbd95802b68002037d8a538e824ee25bc67717d70fb880acd61dad7f3377dc9e4327dbee4639c48e4726475e1eb7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2a843148759502e0bd09fb49e56d81e2

SHA1
9fec6e1160e1d0401d9efbc110a5f90025b1ccdb

SHA256
17bbabc54a11e5235778f07625ce45879b9c2e688bddf106326f280b81a2137b

SHA512
26539ad4fe54e8bbfdb8d11e28bf6b351099d47137808d5efce273ad0df2273f3504a19d32df4ba3f2073cd348eaf834863bcc0cd1a1a42e0e1eafededb69836

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_000002

Filesize
17KB

MD5
84e562d1eb215980c7dcf3bfe78f3c68

SHA1
99f28ae6f8798cafaafa58b6615c022f2fd21897

SHA256
a87fc77528d59967f882ab98168a281e881abe215aa022271b517aaa53c7483a

SHA512
e72d2241917d7ca134bbacbba7031d0e0cbda866afcc49ad453d17ecb40976c5b40f38fb67224fb01faec2ede6c24f979f17b164d752709c672faa0d09ad0f73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\f_00000a

Filesize
19KB

MD5
8165ed8e5903e78c5898f5b483ad6e18

SHA1
f8f3c21488147294ec0dd0363ddcb84f765e7244

SHA256
b182b10d9c741e5ac9b9f72160e4314816e7f17acf79a75e0aad797302b10003

SHA512
5c1d1f24650b9f18d88768472059d43c2a3df1e535d4719ed1e3fb98a657074e7d4a3ed79a3f75751fbe0371c18a636910fc905b54d0efc389c8aa91dbf0f325

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
9f9a99dd246935b18944339a6f255917

SHA1
d03089a45c1bf22f52926b22b0eec2d346389be7

SHA256
39bb19711facd3b09234ca7b04d47900c9adc5ba95449f357a7ef237d1c989dd

SHA512
533d04a6e5c122f4632865190adc358edd6baa62c80343dde5c7b6e95cae105e666d82cbb5526c6bc1834b06d798f6982e80bac103c02f5275086a713dc89f54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
6cebe96a348fc4472a10cf7698dbeb2b

SHA1
307ff7aa0e065030f9773500891fcfb83c5d87b0

SHA256
bfd40c7fc258c0914d95e5dc298a6e66827d05fc782269c6cdc85ccffe64fd62

SHA512
3c4c6de1dec1ad804b4b22d42063d4f1c9da2c93a4b9a641c54fcb97f2f899d0431776fbeeeca4e19e40d4a226d7afb814630af5432c6218b115a0e362c22439

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
2f5227ff701a4a59cfade95a5c220672

SHA1
34e47b8fdffbc891b35fe835b17d51f5f2aa159e

SHA256
3c4920b0ed637a47ae4d7ff2a6f02a43168f0d502826dcc3f8e573df6548ed27

SHA512
886a94482a05977f3c52d06bdd0f80818422644940be90bd66231939611960bf61aca3d394f2e7deab207f7464ff1e68ed60757a9754d390131730fc92cefb26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe594abb.TMP

Filesize
88KB

MD5
46a558ebdff809b017f82ef9dd7b6758

SHA1
a3da91df3884f5ed1b208dcdaf86dd95207fac22

SHA256
1a2b067c6ee7a8004ab061c320389aa4adb0ee3d31149784a285c78a7e35c5db

SHA512
5ae275eada805090863283d8198e8af59e640cdc1782b152d0a1809021eccbf7035c20af1b28a67bc1d32b34e99242617f348c63311707a3675a90202ff1c411

Download Submit
C:\Users\Admin\AppData\Roaming\NMIjTWae.vbs

Filesize
260B

MD5
f8c698302661d090d3a9ebd479f66f8f

SHA1
6d186fc1509c712f9fc4b510ed64a1887cc540ab

SHA256
a7421321cd35bf11e5c6b2d44ebee97dd82102253a9ff89cd3713d4c2220462a

SHA512
fc95c2ee06a0d3f5c111714e9b336e29be2884e1f2fbeffaf8ca1eea10fb2e4ce4394803d22a4e1b2cb1565eb7a82ffde80a31a33446c07619a8cbfa8299b6d3

Download Submit
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.zip.crdownload

Filesize
6.3MB

MD5
42fbebc5a1cc70d8f44f0bcd44c0e339

SHA1
fab8d838022d11d136b9b64d16394c276a90a86a

SHA256
0ade46c70e72d18fa408e8b0a79791363f5fb52f34a0924829f936bf1d3e9085

SHA512
455fa7aee90dc05fc52755733364a553af1485f10eb1ac095d0e0a32eb6896a4415424d99b4f9a9c4b83b7991438d7ce3c4c1ff73a62f2aecc8f1477a13ca713

Download Submit
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270.exe

Filesize
6.5MB

MD5
1a699d18fc42426c1fdfe7ad01a42d20

SHA1
f8b0d7c0019f48ffb8f6d0f0634104751cc5842f

SHA256
095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270

SHA512
b6c0abad59318341f2ce0c9057df1d3dfe6421da36519b15927bbe769807ca007761bc47a64e69513ddb9d9cd02f8f2df6bce755a5c26adfadacd62da08ba253

Download Submit
C:\Users\Admin\Downloads\095721924420baff3670898412fc911ff32540544e8fad5495d334cded931270\bad_13C2C36968370DA3.txt

Filesize
5KB

MD5
20aa8ac0ac70e2777bf61ab83738ae7c

SHA1
2f39bfe4403daa1b0ccb99ce188a201ad9068591

SHA256
bd4e86356a0078778df7026d9e6b4d519b646cdb93afb6b8a17930aef18e041c

SHA512
1364c7df6858dd5bb4d241b136ae439fec26d5ec3648e5b802a6f58746c8982799b8aa8ae47150b6d38997563574680ede0939e6f4a08de614ebeab6d8a34c54

Download Submit
\??\pipe\crashpad_744_EGMWDLXARKQQOQFU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/716-13801-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1368-13657-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1612-542-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/1612-539-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/1612-537-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/1612-538-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/1612-540-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/1612-541-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/1612-534-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/1612-535-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/1612-536-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/1860-13764-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2216-13812-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2996-13602-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3152-13714-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3504-13805-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3612-13554-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/3936-13548-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4400-13784-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4576-13700-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4612-13772-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4628-13673-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4784-13815-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5116-523-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/5116-521-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/5116-518-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/5116-525-0x0000000000400000-0x0000000000FA5000-memory.dmp

Filesize
11.6MB

Download
memory/5116-520-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/5116-516-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/5116-522-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/5116-517-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/5116-519-0x0000000002C00000-0x0000000002C01000-memory.dmp

Filesize
4KB

Download
memory/5224-13799-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5264-13762-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5280-13807-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5508-13668-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5520-13651-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5532-13613-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5532-13611-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5612-13653-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5776-12005-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5896-13758-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6036-13776-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6212-13671-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6216-13797-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6284-13593-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6300-13774-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6308-13617-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6308-13615-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6344-13619-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6444-13692-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6472-13698-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6588-13780-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6716-13817-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6728-13803-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/6956-13642-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7120-13678-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7156-13647-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7256-13687-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7332-13650-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7352-13622-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7360-13703-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7360-13701-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7440-13794-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7456-13606-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7468-13541-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7500-13662-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7524-13637-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7536-13819-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7544-13626-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7548-13635-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7704-13809-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7720-13623-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7732-13644-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7740-13782-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7760-13640-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7944-13680-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8064-13756-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8080-13607-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8080-13609-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8240-13766-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8268-13549-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8328-13767-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8328-13769-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8428-13553-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8428-13551-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8436-13790-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8452-13786-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8532-13778-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8556-13788-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8624-13547-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8656-13600-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8684-13792-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8692-13604-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8708-13555-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8708-13557-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8720-13594-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8720-13596-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8788-13760-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8872-13543-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8872-13545-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/8876-13694-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9024-13689-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9044-13707-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9220-13696-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9340-13664-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9504-13660-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9628-13682-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9644-13666-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9740-13676-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9852-13655-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9860-13739-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/9936-13628-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/10092-13630-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/10136-13711-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/10140-13705-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/10176-13598-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/10216-13709-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download