Overview

overview

10

Static

static

a92da5f4be...68.exe

windows7-x64

10

a92da5f4be...68.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    159s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68.exe

  • Size

    1.3MB

  • MD5

    5818b9c7e1e4f408f28f5a6c6d0a7565

  • SHA1

    b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

  • SHA256

    a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

  • SHA512

    9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

  • SSDEEP

    24576:UJE8PA1dmGeDye5Dt3c2kFOoJU8PaTRFmYvQ49sMZ5D34zvXjycTZPVP6:qtPA8f+e5DpAc6wfmYvXZ5cjZPVP6

Score
10/10
darkcometthenthackerevasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

THENTHACKER

C2

thenthacker.no-ip.org:1604

Mutex

DC_MUTEX-WPNYUQ7

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    92Uc0EZwdkTP

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 36 IoCs
    persistence
  • Executes dropped EXE 64 IoCs
  • Sets file to hidden 1 TTPs 64 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 36 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68.exe
    "C:\Users\Admin\AppData\Local\Temp\a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
      "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:204
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:1840
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
          PID:4272
        • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
          "C:\Windows\system32\MSDCSC\msdcsc.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4260
          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
            "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Checks computer location settings
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1580
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1720
              • C:\Windows\SysWOW64\attrib.exe
                attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                6⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:3316
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3896
              • C:\Windows\SysWOW64\attrib.exe
                attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                6⤵
                • Sets file to hidden
                • Views/modifies file attributes
                PID:1448
            • C:\Windows\SysWOW64\notepad.exe
              notepad
              5⤵
                PID:3404
              • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\msdcsc.exe
                "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\msdcsc.exe"
                5⤵
                • Executes dropped EXE
                PID:380
                • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                  "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                  6⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3464
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                    7⤵
                      PID:1212
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                        8⤵
                        • Sets file to hidden
                        • Views/modifies file attributes
                        PID:5084
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                      7⤵
                        PID:4408
                        • C:\Windows\SysWOW64\attrib.exe
                          attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                          8⤵
                          • Sets file to hidden
                          • Views/modifies file attributes
                          PID:4156
                      • C:\Windows\SysWOW64\notepad.exe
                        notepad
                        7⤵
                          PID:4868
                        • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                          "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                          7⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:1444
                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                            "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                            8⤵
                            • Modifies WinLogon for persistence
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Adds Run key to start application
                            • Drops file in System32 directory
                            • Modifies registry class
                            PID:1964
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                              9⤵
                                PID:2588
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                  10⤵
                                  • Sets file to hidden
                                  • Views/modifies file attributes
                                  PID:3372
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                9⤵
                                  PID:100
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                    10⤵
                                    • Sets file to hidden
                                    • Views/modifies file attributes
                                    PID:1152
                                • C:\Windows\SysWOW64\notepad.exe
                                  notepad
                                  9⤵
                                    PID:308
                                  • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                    "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                    9⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    PID:2020
                                    • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                      "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                      10⤵
                                      • Modifies WinLogon for persistence
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Adds Run key to start application
                                      PID:944
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                        11⤵
                                          PID:2256
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                            12⤵
                                            • Sets file to hidden
                                            • Views/modifies file attributes
                                            PID:1420
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                          11⤵
                                            PID:5100
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                              12⤵
                                              • Sets file to hidden
                                              • Views/modifies file attributes
                                              PID:2568
                                          • C:\Windows\SysWOW64\notepad.exe
                                            notepad
                                            11⤵
                                              PID:3984
                                            • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                              "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                              11⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              PID:4676
                                              • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                12⤵
                                                • Modifies WinLogon for persistence
                                                • Executes dropped EXE
                                                • Checks computer location settings
                                                • Adds Run key to start application
                                                • Drops file in System32 directory
                                                • Modifies registry class
                                                PID:2224
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                  13⤵
                                                    PID:4284
                                                    • C:\Windows\SysWOW64\attrib.exe
                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                      14⤵
                                                      • Sets file to hidden
                                                      • Views/modifies file attributes
                                                      PID:4648
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                    13⤵
                                                      PID:116
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                        14⤵
                                                        • Views/modifies file attributes
                                                        PID:224
                                                    • C:\Windows\SysWOW64\notepad.exe
                                                      notepad
                                                      13⤵
                                                        PID:4500
                                                      • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                        "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                        13⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Modifies registry class
                                                        PID:4032
                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                          "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                          14⤵
                                                          • Modifies WinLogon for persistence
                                                          • Executes dropped EXE
                                                          • Checks computer location settings
                                                          • Adds Run key to start application
                                                          • Drops file in System32 directory
                                                          PID:312
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                            15⤵
                                                              PID:3476
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                16⤵
                                                                • Sets file to hidden
                                                                • Views/modifies file attributes
                                                                PID:5016
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                              15⤵
                                                                PID:3768
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                  16⤵
                                                                  • Sets file to hidden
                                                                  • Views/modifies file attributes
                                                                  PID:1652
                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                notepad
                                                                15⤵
                                                                  PID:5044
                                                                • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                  "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                  15⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  PID:536
                                                                  • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                    16⤵
                                                                    • Modifies WinLogon for persistence
                                                                    • Executes dropped EXE
                                                                    • Checks computer location settings
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    • Modifies registry class
                                                                    PID:4348
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                      17⤵
                                                                        PID:4620
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                          18⤵
                                                                          • Sets file to hidden
                                                                          • Views/modifies file attributes
                                                                          PID:624
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                        17⤵
                                                                          PID:3816
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                            18⤵
                                                                            • Sets file to hidden
                                                                            • Views/modifies file attributes
                                                                            PID:1408
                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                          notepad
                                                                          17⤵
                                                                            PID:4168
                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                            "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                            17⤵
                                                                              PID:1592
                                                                              • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                18⤵
                                                                                • Modifies WinLogon for persistence
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                • Adds Run key to start application
                                                                                • Drops file in System32 directory
                                                                                • Modifies registry class
                                                                                PID:3340
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                  19⤵
                                                                                    PID:4148
                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                      20⤵
                                                                                      • Executes dropped EXE
                                                                                      • Sets file to hidden
                                                                                      • Adds Run key to start application
                                                                                      • Views/modifies file attributes
                                                                                      PID:1592
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                    19⤵
                                                                                      PID:4016
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                        20⤵
                                                                                        • Sets file to hidden
                                                                                        • Views/modifies file attributes
                                                                                        PID:4024
                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                      notepad
                                                                                      19⤵
                                                                                        PID:1064
                                                                                      • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                        "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                        19⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        PID:3720
                                                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                          20⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Executes dropped EXE
                                                                                          • Checks computer location settings
                                                                                          • Adds Run key to start application
                                                                                          • Modifies registry class
                                                                                          PID:624
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                            21⤵
                                                                                              PID:3368
                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                22⤵
                                                                                                • Sets file to hidden
                                                                                                • Views/modifies file attributes
                                                                                                PID:4108
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                              21⤵
                                                                                                PID:8
                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                  22⤵
                                                                                                  • Sets file to hidden
                                                                                                  PID:5136
                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                notepad
                                                                                                21⤵
                                                                                                  PID:5148
                                                                                                • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                  "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                  21⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Adds Run key to start application
                                                                                                  PID:5184
                                                                                                  • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                    22⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks computer location settings
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies registry class
                                                                                                    PID:5284
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                      23⤵
                                                                                                        PID:5444
                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                          24⤵
                                                                                                          • Sets file to hidden
                                                                                                          • Views/modifies file attributes
                                                                                                          PID:5528
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                        23⤵
                                                                                                          PID:5472
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                            24⤵
                                                                                                            • Sets file to hidden
                                                                                                            PID:5552
                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                          notepad
                                                                                                          23⤵
                                                                                                            PID:5568
                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                            "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                            23⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Adds Run key to start application
                                                                                                            PID:5604
                                                                                                            • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                              24⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks computer location settings
                                                                                                              • Adds Run key to start application
                                                                                                              • Drops file in System32 directory
                                                                                                              PID:5692
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                25⤵
                                                                                                                  PID:5808
                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                    26⤵
                                                                                                                    • Sets file to hidden
                                                                                                                    • Views/modifies file attributes
                                                                                                                    PID:5900
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                  25⤵
                                                                                                                    PID:5844
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                      26⤵
                                                                                                                      • Sets file to hidden
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:5920
                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                    notepad
                                                                                                                    25⤵
                                                                                                                      PID:5936
                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                      "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                      25⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5968
                                                                                                                      • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                        "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                        26⤵
                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks computer location settings
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Modifies registry class
                                                                                                                        PID:6048
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                          27⤵
                                                                                                                            PID:1240
                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                              28⤵
                                                                                                                              • Sets file to hidden
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:3340
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                            27⤵
                                                                                                                              PID:1268
                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                28⤵
                                                                                                                                • Sets file to hidden
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:4712
                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                              notepad
                                                                                                                              27⤵
                                                                                                                                PID:3756
                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                27⤵
                                                                                                                                  PID:1972
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                    28⤵
                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:5240
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                      29⤵
                                                                                                                                        PID:3620
                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                          30⤵
                                                                                                                                          • Sets file to hidden
                                                                                                                                          • Views/modifies file attributes
                                                                                                                                          PID:5300
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                        29⤵
                                                                                                                                          PID:5532
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                            30⤵
                                                                                                                                            • Sets file to hidden
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:5272
                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                          notepad
                                                                                                                                          29⤵
                                                                                                                                            PID:3652
                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                            "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                            29⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:3008
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                              30⤵
                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:5636
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                31⤵
                                                                                                                                                  PID:5860
                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                    32⤵
                                                                                                                                                    • Sets file to hidden
                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                    PID:5740
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                  31⤵
                                                                                                                                                    PID:5728
                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                      32⤵
                                                                                                                                                      • Sets file to hidden
                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                      PID:5696
                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                    notepad
                                                                                                                                                    31⤵
                                                                                                                                                      PID:5988
                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                      "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                      31⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:6008
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                        32⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5760
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                          33⤵
                                                                                                                                                            PID:5180
                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                              34⤵
                                                                                                                                                              • Sets file to hidden
                                                                                                                                                              PID:5216
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                            33⤵
                                                                                                                                                              PID:1908
                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                34⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                PID:1972
                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                              notepad
                                                                                                                                                              33⤵
                                                                                                                                                                PID:5140
                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                33⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                PID:6128
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                  34⤵
                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:5228
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                    35⤵
                                                                                                                                                                      PID:5360
                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                        36⤵
                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                        PID:1384
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                      35⤵
                                                                                                                                                                        PID:5528
                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                          36⤵
                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                          PID:5756
                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                        notepad
                                                                                                                                                                        35⤵
                                                                                                                                                                          PID:5976
                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                          "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                          35⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:3216
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                            36⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:5636
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                              37⤵
                                                                                                                                                                                PID:5408
                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                  38⤵
                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                  PID:5784
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                37⤵
                                                                                                                                                                                  PID:5212
                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                    38⤵
                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                    PID:5804
                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                  notepad
                                                                                                                                                                                  37⤵
                                                                                                                                                                                    PID:3340
                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                    37⤵
                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    PID:5760
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                      38⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:6016
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                        39⤵
                                                                                                                                                                                          PID:2812
                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                            40⤵
                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                            PID:1500
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                          39⤵
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:5324
                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                            40⤵
                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                            PID:4368
                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                          notepad
                                                                                                                                                                                          39⤵
                                                                                                                                                                                            PID:3552
                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                            39⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            PID:5368
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                              40⤵
                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              PID:4380
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                41⤵
                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                41⤵
                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                  notepad
                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    PID:4092
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:480
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                            PID:4276
                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                              PID:5912
                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                            notepad
                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                        PID:6028
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                  PID:5524
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                  PID:1756
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                                                    PID:5188
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                      PID:764
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                            PID:2032
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                              PID:2148
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                PID:3500
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                PID:3716
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:4264
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                      PID:6064
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                        PID:1320
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                        51⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:764
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                        51⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                              PID:460
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                PID:4632
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                          PID:1980
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:5492
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                                  PID:5192
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                    PID:5712
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                                                                              PID:3852
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                notepad
                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  PID:1656
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                        PID:3668
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                          PID:1484
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                          PID:640
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                          notepad
                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                            PID:5676
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                PID:3400
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                    PID:3252
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                      PID:3196
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    PID:4468
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                    notepad
                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      PID:840
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                            PID:2036
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                              PID:6148
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                              PID:5016
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                PID:6172
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                              notepad
                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                PID:6188
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                PID:6224
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                  PID:6300
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                      PID:6416
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                        PID:6540
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                        PID:6452
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                          attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                          PID:6524
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                        notepad
                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                          PID:6556
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                          PID:6588
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            PID:6700
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                PID:6820
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                  PID:6916
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6864
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                    PID:6936
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                  notepad
                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6952
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                    PID:6988
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                      PID:7072
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6176
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                            notepad
                                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6240
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              PID:6260
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe"
                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6344
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Users\Admin\AppData\Roaming\Adobe\Java.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                      PID:3480
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Users\Admin\AppData\Roaming\Adobe" +s +h
                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                      notepad
                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1044
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe"
                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6628
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2052
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1420
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3632
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1484
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4100
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3924
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:2720
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1484
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4384
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3908
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5760
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:6124
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5220
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3552
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:5392
                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                            PID:6056
                                                                                                                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5732
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5740
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5632
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5968
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:6040
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5676
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                              • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:1632
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:6060
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:6268
                                                                                                                                                                                                                                  • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    PID:6368
                                                                                                                                                                                                                                  • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:6636
                                                                                                                                                                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6768
                                                                                                                                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:7036
                                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:7140
                                                                                                                                                                                                                                        • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:6132
                                                                                                                                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:6284

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1004

                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1158

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1060

                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1158

                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DI-TDR7.JPG
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            690KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            14f0e088c890ad590f84ae2170e6a94d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4fa31298a2824081738ab90d17aaaa03353e1b0e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            56adf781705c9cb171f965d6dd31a07aca27ced68f4d2e6c9d37dab2d1fb909c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            88ece7985fec461e599f126e68b92daf1228e8057a40a3d9675a53867d613c059fa1b33da7c33f068db5b114da05401a8bef0b6856df9a9287d02d68d071c75d

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bl4ckb4nd
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            34KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            46f30194bd5792c73072d6cd782820d6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            367635e048ba13741b461b864b8adc76841ae476

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8bc9f898a96c6c90517a24919a45888f68d92232a8592b3cae8610c2d279cfa3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            888aec428b266b4aed6e895d0c075c56780548396f678720423de01a173911e3d00229bd1672bf073de54323043d44277974f15852393b4d97b915561a5ca510

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Adobe\Java.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\92Uc0EZwdkTP\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5818b9c7e1e4f408f28f5a6c6d0a7565

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b18ddaf0338af454365b5acd9d5d3ac7a6a890e0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a92da5f4be8e9765ace3961ffc07677f0645589dade7fa271a2dc453f751cb68

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9fbc0219849c3735c35972cb323a393341f2691913676bf1d01159579fe28198db310b6738113550874e14b8c43b050d633c63b34c0a4e1f00fbe53ba4beb057

                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                          • memory/100-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/116-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/204-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/224-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/308-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/312-246-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/312-242-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/312-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/312-236-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/380-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/380-167-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/536-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/624-282-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/624-255-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/624-285-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/624-279-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/944-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/944-204-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/944-215-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/944-211-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1008-139-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1008-137-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1008-133-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1008-148-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1064-273-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1152-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1212-173-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1408-256-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1420-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1444-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1444-187-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1444-183-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1448-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1580-154-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1580-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1580-166-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1580-160-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1592-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1592-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1652-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1720-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1772-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1840-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1964-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1964-188-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1964-192-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/1964-199-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2020-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2020-201-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2224-223-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2224-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2224-229-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2256-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2568-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/2588-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3008-303-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3316-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3340-276-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3340-267-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3340-265-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3340-263-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3372-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3404-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3464-179-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3464-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3464-171-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3476-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3720-277-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3720-281-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3720-274-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3768-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3816-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3896-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/3984-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4016-269-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4024-272-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4032-230-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4032-234-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4032-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4148-268-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4156-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4168-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4260-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4260-150-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4272-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4284-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4296-136-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4296-132-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4348-257-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4348-251-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4348-261-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4348-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4380-315-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4408-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4500-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4620-252-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4648-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4676-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4868-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/4988-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5016-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5044-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5084-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5100-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5184-287-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5184-290-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5228-308-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5240-301-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5240-302-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5284-293-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5284-292-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5368-313-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5368-314-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5604-294-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5636-310-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5636-309-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5636-304-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5636-305-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5692-295-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5692-296-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5760-306-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/5968-297-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/6016-311-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/6016-312-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/6048-300-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/6048-299-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/6048-298-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                          • memory/6128-307-0x0000000000400000-0x00000000006C7000-memory.dmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.8MB

                                                                                                                                                                                                                                            Download