Resubmissions
18/08/2026, 14:36
260818-ryz92shg4718/08/2026, 14:16
260818-rldkhshf72918/08/2026, 14:06
260818-rerhsshf55918/08/2026, 14:03
260818-rcp7ystcqg5Analysis
- user interaction
yes - max time kernel
411s - max time network
520s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/08/2026, 14:06
General
- Target GenP.v4.2.1/GenP-v4.2.1.exe
- Size 65.5MB
- Sample260818-rerhsshf55
- SHA256 7248e21019e911b6a4ecbb143053c1297da4ce972697e00e06e72b8217fa43a8
Score
9/10
Malware Config
Signatures
- Renames multiple (171) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 36 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 29 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 53 IoCs
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 36 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\GenP.v4.2.1\GenP-v4.2.1.exe"C:\Users\Admin\AppData\Local\Temp\GenP.v4.2.1\GenP-v4.2.1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -store Root mitmproxy3⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {e5c32e9a-de35-40f7-b365-25f4470fb102} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {9ba71d88-3be1-4039-82e5-e2d4daad388f} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 27276 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {00448a65-a0a3-47ef-8fa4-593384c15d66} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3928 -prefsLen 27276 -prefMapHandle 3932 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {d3078110-04f2-452a-9851-54a13f9e8ef5} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34775 -prefMapHandle 4408 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4388 -initialChannelId {25a2178b-82eb-4e30-a6c6-a611c4ec0633} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4856 -prefsLen 35012 -prefMapHandle 2788 -prefMapSize 270279 -ipcHandle 4924 -initialChannelId {bb27a852-13a9-4bcc-8043-8de6a40c4b9e} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 32952 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {c35614cf-05d2-40af-81e7-713618d3bcc1} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {3b104de3-44f6-4fdf-aa0f-de82a676b2e6} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {6df4cb9d-fa9c-4c52-8d1b-ebadc227c685} -parentPid 3304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdf8adc728,0x7ffdf8adc734,0x7ffdf8adc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,5612899320251823709,5884822014251268507,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,1789995289057163731,10450062960593201445,262144 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,8425743027919164068,7736959431287868831,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,10246720596306311083,4007910421910186708,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,11343452866721741000,4834755823125709047,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,15544789507446721243,13391502390320650721,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,12544345427654467135,3071766384152780676,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,8614813266608098673,5122839455552997399,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5796,i,10124682809750526012,13736976031141830602,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,15095187970144664691,5537004826854810825,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,17991998472229418380,2385999175242317471,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,6305701542519082051,2365696265959223617,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4588,i,6462039404846832954,10059733652962903340,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3296,i,16131844282573842729,6729385313445489125,2097152 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4612 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,1298329591126058922,14137253821346806874,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Creative_Cloud_Set-Up_7474.exe"C:\Users\Admin\Downloads\Creative_Cloud_Set-Up_7474.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --mojo-named-platform-channel-pipe=3336.4880.25560195462231349673⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x154,0x17c,0x180,0x158,0x188,0x7ffdf874b078,0x7ffdf874b084,0x7ffdf874b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1372,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2316,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3684,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4580,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=788,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5096,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4976,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4968,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=952,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Adobe\webview2\Creative_Cloud_Set-Up_7474.exe\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4992,i,17706039365125191873,12397360773065213107,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:84⤵
-
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --mojo-named-platform-channel-pipe=3336.4880.17446369324701077473⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x18c,0x7ffdf874b078,0x7ffdf874b084,0x7ffdf874b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2060,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2288,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4844,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4856,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4600,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=5232,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5280,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4656,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=944,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\{456E5FA6-CB82-44C7-B7C4-16516AE96995}\EBWebView" --webview-exe-name=Creative_Cloud_Set-Up_7474.exe --webview-exe-version=2.14.0.82 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=5100,i,5494927858420176697,11210740984778103486,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:84⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\customhook\AdobeIPCBrokerCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\customhook\AdobeIPCBrokerCustomHook.exe" -uninstall3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe" --VC14_win32=1 --VC14_win64=1 --VC14.1_win32=1 --VC14.1_win64=13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\32bit\vcredist_x86.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\32bit\vcredist_x86.exe" /q /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{B4821BB0-7126-4329-9AEB-E1B20B0B756A}\.cr\vcredist_x86.exe"C:\Windows\Temp\{B4821BB0-7126-4329-9AEB-E1B20B0B756A}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\32bit\vcredist_x86.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720 /q /norestart5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{803573B6-6B4A-465D-81EF-5F1D0B512E64}\.be\VC_redist.x86.exe"C:\Windows\Temp\{803573B6-6B4A-465D-81EF-5F1D0B512E64}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{12D0F47A-135E-4003-A377-557A769AC28A} {8CCD4487-9154-4BC7-A1C5-E0D7969C5F96} 60766⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{085DDA4C-7CA7-4CC4-9AEA-412AE1EEFEF5} {7A92C1DF-9A32-467E-A886-A88550263037} 51367⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{085DDA4C-7CA7-4CC4-9AEA-412AE1EEFEF5} {7A92C1DF-9A32-467E-A886-A88550263037} 51368⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{7BD87C5E-2E18-4BEF-9029-95008201F166} {4B8BF690-0046-419A-B3F1-DAB5EEC80237} 79889⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\64bit\vcredist_x64.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\64bit\vcredist_x64.exe" /q /norestart4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{8AFF4D0D-7274-415C-ACE3-009D4A107512}\.cr\vcredist_x64.exe"C:\Windows\Temp\{8AFF4D0D-7274-415C-ACE3-009D4A107512}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\vc14\64bit\vcredist_x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=688 /q /norestart5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{2BBA530D-0B2A-44B4-B3E9-F5EC975FB4D6}\.be\VC_redist.x64.exe"C:\Windows\Temp\{2BBA530D-0B2A-44B4-B3E9-F5EC975FB4D6}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{26734A23-A8BB-4F79-A3A8-51C6EA9587FA} {207204DE-4A20-4E7D-8F6B-182FF916CD62} 70646⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1292 -burn.embedded BurnPipe.{1F35C771-4117-4FD0-817D-2C2C79AED818} {7EA3BF11-5AED-44CA-8DD5-E6FEF6D8261D} 18247⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=568 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1292 -burn.embedded BurnPipe.{1F35C771-4117-4FD0-817D-2C2C79AED818} {7EA3BF11-5AED-44CA-8DD5-E6FEF6D8261D} 18248⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{ABC30846-F412-4B8B-983E-EE4FB17CE453} {A6642566-CF24-4FBB-84D0-366776B0E9B8} 71609⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomhook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomhook.exe" -install3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" /setintegritylevel medium4⤵
- Modifies file permissions
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomhook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\customhook\AdobeIPCBrokerCustomhook.exe" -install3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" /setintegritylevel medium4⤵
- Modifies file permissions
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\customhook\ADSCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\customhook\ADSCustomHook.exe" --install=13⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\customhook\HDCoreCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\customhook\HDCoreCustomHook.exe" --install=13⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\AdobeGenuineClient\customhook\gccustomhook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\AdobeGenuineClient\customhook/gccustomhook" --source=ADC --workflow=13⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Common Files\Adobe\Adobe Desktop Common\RemoteComponents\UPI\customhook\UPICustomHook.exe"C:\Program Files\Common Files\Adobe\Adobe Desktop Common\RemoteComponents\UPI\customhook\UPICustomHook.exe" -i3⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\Creative Cloud Desktop App.exe"C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\Creative Cloud Desktop App.exe" --register=true3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll"4⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll"5⤵
- Modifies registry class
-
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud CustomHook.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud CustomHook.exe" --install=13⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeServiceInstaller.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeServiceInstaller.exe" --register=1 --servicePath="C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe" --serviceLabel=AdobeUpdateService3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\Adobe Installer.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\Adobe Installer.exe" --pipename={A855047B-8C42-401C-B2D8-59AD63694350}3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe" --mode=CCDI --lbsWorkflowID={DB21DF06-FF16-4C80-AF44-913C17705A59} --lbsInstallerWorkflowID={F217C595-D55A-4CE6-BBCC-6C72CC4B8763} --skipCCDUpdate=true --helperBridgeName={F02FB421-1EEA-4E69-8855-45673E84DA29} --appletID=AppsPanel_BL --appletVersion=1.0 --inputXmlPath="C:\Users\Admin\AppData\Local\Temp\productInfo.xml"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRWindowsClientService.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRWindowsClientService.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" updatepvbpreference a75d80c7-0e7a-48b7-9272-0812c501f92a 0 0 0 04⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-3336 C:\Users\Admin\Downloads\Creative_Cloud_Set-Up_7474.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5424,i,9990214009378385096,14272260599399552310,262144 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,18052140461016955126,11545059494946799116,524288 --field-trial-handle=2064,i,9363414708139578821,12151266081246024503,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 59d8f56c-67a4-4ad9-9b6e-618888d088bb 0 0 02⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Program Files\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.190 Safari/537.36 CreativeCloud/6.10.0.253" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --mojo-platform-channel-handle=2172 --field-trial-handle=2176,i,5021261440221361392,14603175305145168184,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference db474238-f64b-4fe9-8554-f65fff45abca 0 0 03⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --locales-dir-path="C:\Program Files\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.190 Safari/537.36 CreativeCloud/6.10.0.253" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --mojo-platform-channel-handle=2536 --field-trial-handle=2176,i,5021261440221361392,14603175305145168184,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference d8d4fd76-88f5-4e52-a25b-eee648906030 0 0 03⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:\Program Files\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.190 Safari/537.36 CreativeCloud/6.10.0.253" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --mojo-platform-channel-handle=2584 --field-trial-handle=2176,i,5021261440221361392,14603175305145168184,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 86784acd-823c-4e06-81a2-ce183e1bb8ff 0 0 03⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe" --type=renderer --locales-dir-path="C:\Program Files\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.190 Safari/537.36 CreativeCloud/6.10.0.253" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --js-flags=--expose-gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2600 --field-trial-handle=2176,i,5021261440221361392,14603175305145168184,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 008529ac-69fd-4f0e-9f6a-4dc01eb47b64 0 0 03⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6156 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe" --type=renderer --locales-dir-path="C:\Program Files\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.190 Safari/537.36 CreativeCloud/6.10.0.253" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --js-flags=--expose-gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3416 --field-trial-handle=2176,i,5021261440221361392,14603175305145168184,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 343e17b9-c3b3-426c-bfd1-fca035269158 0 0 03⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6784 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6784 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe" --onOSstartup=true --showwindow=false --waitForRegistration=true2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRWindowsClientService.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRWindowsClientService.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" updatepvbpreference 1bcd56ef-3ce3-4e88-9512-15e47ba704ff 0 0 0 03⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=LiveType_BL --remoteAppletInstanceID=98386FC2-7A1C-4163-8B32-A389EC14ACF1 --remoteHelper=CCH_LiveType --vulcanID=COSY3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 368b40af-3754-4504-a339-aa4e8cbee5cd 0 0 04⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
- Executes dropped EXE
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-7984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-7984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-7984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"4⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6732 C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6732 C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe"3⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=UPI_BL --remoteAppletInstanceID=98386FC2-7A1C-4163-8B32-A389EC14ACF1 --remoteHelper=CCH_UPI --vulcanID=CCH_UPI3⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference bb85113c-d7da-439f-b442-991d7fbf7cae 0 0 04⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-5944 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-5944 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6732 C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\adobe_licensing_helper.exeadobe_licensing_helper.exe --caller=CreativeCloud26.10.0.252.3 --devicecorrelation3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=UPI_BL --remoteAppletInstanceID=98386FC2-7A1C-4163-8B32-A389EC14ACF1 --remoteHelper=CCH_UPI --vulcanID=CCH_UPI3⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference bb1aa653-0b99-4295-88b7-0be8de0489df 0 0 04⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=LiveType_BL --remoteAppletInstanceID=98386FC2-7A1C-4163-8B32-A389EC14ACF1 --remoteHelper=CCH_LiveType --vulcanID=COSY3⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 98a0188b-241f-4b41-b3af-306054ac33ca 0 0 04⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=UPI_BL --remoteAppletInstanceID=98386FC2-7A1C-4163-8B32-A389EC14ACF1 --remoteHelper=CCH_UPI --vulcanID=CCH_UPI3⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference c7715654-ab73-4016-b9bc-b964e4d127a2 0 0 04⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe"2⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud UI Helper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --locales-dir-path="C:\Program Files\Common Files\Adobe\Adobe Desktop Common\CEF\locales" --log-severity=warning --user-agent="Mozilla/5.0 (Windows NT 10.0.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.190 Safari/537.36 CreativeCloud/6.10.0.253" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\CEF.log" --mojo-platform-channel-handle=4768 --field-trial-handle=2176,i,5021261440221361392,14603175305145168184,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:22⤵
- Checks processor information in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference f5256718-2ef8-4456-a989-51de4e7feb5b 0 0 03⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe" "-launchedbyvulcan-6984 C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe"2⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe" --onOSstartup=true --showwindow=false --waitForRegistration=true2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRWindowsClientService.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRWindowsClientService.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" updatepvbpreference fc870e56-3e1c-4f0b-9036-d557c6064951 0 0 0 03⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Crash Processor.exe"3⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=LiveType_BL --remoteAppletInstanceID=2A6D2F6E-E257-4233-A9DF-B8D4C425CA24 --remoteHelper=CCH_LiveType --vulcanID=COSY3⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 58cd6580-27b1-4acc-9ef5-cb3d9f05765b 0 0 04⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe" --remoteApplet=UPI_BL --remoteAppletInstanceID=2A6D2F6E-E257-4233-A9DF-B8D4C425CA24 --remoteHelper=CCH_UPI --vulcanID=CCH_UPI3⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRWindowsClientService.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" updatepvbpreference 27d7c65a-6cfd-4c6e-8dd4-eb254566d15f 0 0 04⤵
- Checks computer location settings
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\crashlogs"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\dumps"5⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\CRLogTransport.exe" "C:\Program Files\Adobe\Adobe Creative Cloud\ACC" "C:\Users\Admin\AppData\LocalLow\Adobe\CRLogs\applogs"5⤵
-
-
-
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Adobe Crash Processor.exe"4⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\adobe_licensing_helper.exeadobe_licensing_helper.exe --caller=CreativeCloud26.10.0.252.3 --devicecorrelation3⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\AdobeNotificationManager\AdobeNotificationHelper.exe"C:\Program Files (x86)\Common Files\Adobe\AdobeNotificationManager\AdobeNotificationHelper.exe" registerBackGroundTask3⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\LCC\adobe_licensing_helper.exeadobe_licensing_helper.exe --caller=CreativeCloud26.10.0.252.3 --devicecorrelation3⤵
-
-
C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe"C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe"3⤵
-
-
C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe"C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe"3⤵
-
C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe"C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe" "C:\Program Files\Adobe\Adobe Creative Cloud Experience\js\main.js"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Policies\Adobe\CCXProcess""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Policies\Adobe\CCXProcess"6⤵
-
-
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260818101121.log"2⤵
- Executes dropped EXE
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260818101121.log"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3FBDDE26-A479-4C7A-A8C2-E19D5C787D7F} {46EF9FFD-B7E7-42BF-9849-9D9A58E8874A} 80604⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{9F4C2AD7-1ED0-45F7-90E7-1BE89030953C} {3398271C-6D99-4F8D-81D5-9365B3AB88CB} 77805⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1100 -burn.embedded BurnPipe.{9F4C2AD7-1ED0-45F7-90E7-1BE89030953C} {3398271C-6D99-4F8D-81D5-9365B3AB88CB} 77806⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260818101151.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=548 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260818101151.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1B183AA7-D06E-44ED-B700-4C6B6243F573} {11B136A0-6318-4DAD-9A01-4A2959806F1D} 70764⤵
- Adds Run key to start application
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\Adobe Installer.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\Adobe Installer.exe" --pipename={9C6B0A64-C4C3-4C3D-B12F-782ACD604340}2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Adobe\Adobe Desktop Common\RemoteComponents\UPI\ExManCoreLib\AdobeExtensionsService.exe"C:\Program Files\Common Files\Adobe\Adobe Desktop Common\RemoteComponents\UPI\ExManCoreLib\AdobeExtensionsService.exe"3⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\Setup.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\Setup.exe" --pipeName={99B7F411-FA81-4092-BCC8-6093B7CCE4A8}3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRWindowsClientService.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRWindowsClientService.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox" postingestevent dummy 14⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRWindowsClientService.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRWindowsClientService.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox" updatepvbpreference dummy4⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox" "C:\Users\Admin\AppData\Roaming\Adobe\CRLogs\crashlogs"5⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRLogTransport.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\CRLogTransport.exe" "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox" "C:\Users\Admin\AppData\Roaming\Adobe\CRLogs\dumps"5⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe" --VC10_win32=1 --VC11_win32=1 --VC12_win32=1 --VC14_win32=1 --VC14.1_win32=1 --VC10_win64=1 --VC11_win64=1 --VC12_win64=1 --VC14_win64=1 --VC14.1_win64=14⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe" --VC10_win32=1 --VC11_win32=1 --VC12_win32=1 --VC14_win32=1 --VC14.1_win32=1 --VC10_win64=1 --VC11_win64=1 --VC12_win64=1 --VC14_win64=1 --VC14.1_win64=14⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe" --VC10_win32=1 --VC11_win32=1 --VC12_win32=1 --VC14_win32=1 --VC14.1_win32=1 --VC10_win64=1 --VC11_win64=1 --VC12_win64=1 --VC14_win64=1 --VC14.1_win64=14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\Runtime\customhook\RuntimeCustomHook.exe" --VC10_win32=1 --VC11_win32=1 --VC12_win32=1 --VC14_win32=1 --VC14.1_win32=1 --VC10_win64=1 --VC11_win64=1 --VC12_win64=1 --VC14_win64=1 --VC14.1_win64=14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDHelper.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\HDHelper.exe" --command=hduwpInstallPackage --commandArgsXML=C:\ProgramData\Adobe\Installer\{5D7DB960-8651-4899-8C35-B81FEFCBC449} --errorFile=C:\ProgramData\Adobe\Installer\{46A04AFD-FD4C-4E69-8BC2-89B9DC1AAAC0} --uwpFallback=true4⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe"C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HDBox\TokenResolverx64.exe" C:\Users\Admin\AppData\Local\Temp\{A7380F60-3C1C-4704-82F8-3A8B3F727755}4⤵
-
-
C:\Program Files\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe"C:\Program Files\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe" "C:\Program Files\Common Files\Adobe\Creative Cloud Libraries\js\customhook.js" install4⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\customhook\CoreSyncCustomHook.exe"C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\customhook\CoreSyncCustomHook.exe" "--install=C:\Program Files (x86)\Common Files\Adobe" --component=CoreSyncExtension --mode=install --isEnterpriseMode=false4⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"5⤵
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon6⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll",CreateReaderUserSettings6⤵
-
-
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -UserConfig6⤵
-
C:\Windows\System32\ie4uinit.exeC:\Windows\System32\ie4uinit.exe -ClearIconCache7⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /08⤵
-
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /08⤵
-
-
-
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon6⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level6⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff769f755a0,0x7ff769f755ac,0x7ff769f755b87⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=2 --install-level=07⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x270,0x274,0x278,0x23c,0x27c,0x7ff769f755a0,0x7ff769f755ac,0x7ff769f755b88⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6b30e04c8,0x7ff6b30e04d4,0x7ff6b30e04e07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=2 --install-level=07⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff6b30e04c8,0x7ff6b30e04d4,0x7ff6b30e04e08⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --launch-msedge-after-unlock --verbose-logging --system-level7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ff6b30e04c8,0x7ff6b30e04d4,0x7ff6b30e04e08⤵
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe"C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\customhook\CoreSyncCustomHook.exe" "--install=C:\Program Files (x86)\Adobe\Adobe Sync" --component=CoreSync --mode=install --isEnterpriseMode=false4⤵
-
-
-
-
C:\Program Files\WindowsApps\AdobeNotificationClient_6.0.0.1_x86__enpm4xejd91yc\AdobeNotificationClient.exe"C:\Program Files\WindowsApps\AdobeNotificationClient_6.0.0.1_x86__enpm4xejd91yc\AdobeNotificationClient.exe" -ServerName:CreativeCloud.AppXkc26ec7ewq1x9dww5fbpte7xrjdypftp.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5c3d63.rbs
e5c3d68.rbs
e5c3d72.rbs
e5c3d78.rbs
e5c3d87.rbs
e5c3d8b.rbs
e5c3d91.rbs
e5c3d9d.rbs
e5c3da4.rbs
e5c3db3.rbs
Creative Cloud.exe
cr_win_client_config.cfg
RuntimeCustomHook.exe
vcredist_x86.exe
extension_version.txt
Install.log
COSY_7_8_10_32_CoreSyncExtensionUninstaller_7.8.10.1.pimx
AdobeIPCBrokerCustomHook.exe
TXVsdGlVc2Vy.slc
TXVsdGlVc2Vy.slc
hdpim.db
994d3970-d31e-4e68-b6af-a02a5763560f.tmp
CCXProcess.exe
tsconfig.json
LICENSE
index.js
LICENSE
LICENSE
CONTRIBUTING.md
GOVERNANCE.md
LICENSE
stream-browser.js
stream.js
index.js
package.json
LICENSE
README.md
string_decoder.js
md5.js
nil.js
parse.js
regex.js
sha1.js
v3.js
v5.js
validate.js
parse.js
v3.js
v5.js
LICENSE
CRClient.dll
Creative Cloud UI Helper.exe
Creative Cloud.exe
manifest.xml
signatures.xml
color.jsx
main.jsx
main.jsx
ACCC-css-light-main-scss.bundle.js
AEFT-css-dark-main-scss.bundle.js
AEFT-css-darker-main-scss.bundle.js
AEFT-css-generated-10-main-scss.bundle.js
AEFT-css-generated-12-main-scss.bundle.js
AEFT-css-generated-14-main-scss.bundle.js
AEFT-css-generated-16-main-scss.bundle.js
AEFT-css-generated-18-main-scss.bundle.js
AEFT-css-generated-2-main-scss.bundle.js
AEFT-css-generated-20-main-scss.bundle.js
AEFT-css-generated-22-main-scss.bundle.js
AEFT-css-generated-24-main-scss.bundle.js
AEFT-css-generated-26-main-scss.bundle.js
AEFT-css-generated-28-main-scss.bundle.js
AEFT-css-generated-30-main-scss.bundle.js
AEFT-css-generated-32-main-scss.bundle.js
AEFT-css-generated-34-main-scss.bundle.js
AEFT-css-generated-36-main-scss.bundle.js
AEFT-css-generated-38-main-scss.bundle.js
AEFT-css-generated-4-main-scss.bundle.js
AEFT-css-generated-40-main-scss.bundle.js
AEFT-css-generated-42-main-scss.bundle.js
AEFT-css-generated-44-main-scss.bundle.js
AEFT-css-generated-46-main-scss.bundle.js
AEFT-css-generated-48-main-scss.bundle.js
AEFT-css-generated-50-main-scss.bundle.js
AEFT-css-generated-51-main-scss.bundle.js
AEFT-css-generated-53-main-scss.bundle.js
AEFT-css-generated-55-main-scss.bundle.js
AEFT-css-generated-57-main-scss.bundle.js
AEFT-css-generated-59-main-scss.bundle.js
AEFT-css-generated-6-main-scss.bundle.js
AEFT-css-generated-61-main-scss.bundle.js
AEFT-css-generated-63-main-scss.bundle.js
AEFT-css-generated-65-main-scss.bundle.js
AEFT-css-generated-67-main-scss.bundle.js
AEFT-css-generated-69-main-scss.bundle.js
AEFT-css-generated-71-main-scss.bundle.js
AEFT-css-generated-73-main-scss.bundle.js
AEFT-css-generated-75-main-scss.bundle.js
AEFT-css-generated-77-main-scss.bundle.js
AEFT-css-generated-79-main-scss.bundle.js
AEFT-css-generated-8-main-scss.bundle.js
AEFT-css-generated-81-main-scss.bundle.js
AEFT-css-generated-83-main-scss.bundle.js
AEFT-css-generated-85-main-scss.bundle.js
AEFT-css-generated-87-main-scss.bundle.js
AEFT-css-generated-89-main-scss.bundle.js
AEFT-css-generated-91-main-scss.bundle.js
AEFT-css-generated-93-main-scss.bundle.js
AEFT-css-generated-95-main-scss.bundle.js
AEFT-css-generated-97-main-scss.bundle.js
AEFT-css-generated-99-main-scss.bundle.js
DRWV-css-dark-main-scss.bundle.js
DRWV-css-darker-main-scss.bundle.js
DRWV-css-light-main-scss.bundle.js
DRWV-css-lighter-main-scss.bundle.js
ESHR-css-darker-main-scss.bundle.js
ESHR-css-lighter-main-scss.bundle.js
FLPR-css-dark-main-scss.bundle.js
FLPR-css-lighter-main-scss.bundle.js
GoogleSlides-css-lighter-main-scss.bundle.js
IDSN-css-dark-main-scss.bundle.js
IDSN-css-darker-main-scss.bundle.js
IDSN-css-light-main-scss.bundle.js
IDSN-css-lighter-main-scss.bundle.js
ILST-css-dark-main-scss.bundle.js
ILST-css-darker-main-scss.bundle.js
ILST-css-light-main-scss.bundle.js
ILST-css-lighter-main-scss.bundle.js
KBRG-css-dark-main-scss.bundle.js
KBRG-css-darker-main-scss.bundle.js
KBRG-css-light-main-scss.bundle.js
KBRG-css-lighter-main-scss.bundle.js
PHXS-css-dark-main-scss.bundle.js
PHXS-css-darker-main-scss.bundle.js
PHXS-css-light-main-scss.bundle.js
PHXS-css-lighter-main-scss.bundle.js
PPRO-css-dark-main-scss.bundle.js
PPRO-css-darker-main-scss.bundle.js
PPRO-css-generated-10-main-scss.bundle.js
PPRO-css-generated-12-main-scss.bundle.js
PPRO-css-generated-14-main-scss.bundle.js
PPRO-css-generated-16-main-scss.bundle.js
PPRO-css-generated-18-main-scss.bundle.js
PPRO-css-generated-2-main-scss.bundle.js
PPRO-css-generated-20-main-scss.bundle.js
PPRO-css-generated-22-main-scss.bundle.js
PPRO-css-generated-24-main-scss.bundle.js
PPRO-css-generated-26-main-scss.bundle.js
PPRO-css-generated-28-main-scss.bundle.js
PPRO-css-generated-30-main-scss.bundle.js
PPRO-css-generated-32-main-scss.bundle.js
PPRO-css-generated-34-main-scss.bundle.js
PPRO-css-generated-36-main-scss.bundle.js
PPRO-css-generated-38-main-scss.bundle.js
PPRO-css-generated-4-main-scss.bundle.js
PPRO-css-generated-40-main-scss.bundle.js
PPRO-css-generated-42-main-scss.bundle.js
PPRO-css-generated-44-main-scss.bundle.js
PPRO-css-generated-46-main-scss.bundle.js
PPRO-css-generated-48-main-scss.bundle.js
PPRO-css-generated-50-main-scss.bundle.js
PPRO-css-generated-51-main-scss.bundle.js
PPRO-css-generated-53-main-scss.bundle.js
PPRO-css-generated-55-main-scss.bundle.js
PPRO-css-generated-57-main-scss.bundle.js
PPRO-css-generated-59-main-scss.bundle.js
PPRO-css-generated-6-main-scss.bundle.js
PPRO-css-generated-61-main-scss.bundle.js
PPRO-css-generated-63-main-scss.bundle.js
PPRO-css-generated-65-main-scss.bundle.js
PPRO-css-generated-67-main-scss.bundle.js
PPRO-css-generated-69-main-scss.bundle.js
PPRO-css-generated-71-main-scss.bundle.js
PPRO-css-generated-73-main-scss.bundle.js
PPRO-css-generated-75-main-scss.bundle.js
PPRO-css-generated-77-main-scss.bundle.js
PPRO-css-generated-79-main-scss.bundle.js
PPRO-css-generated-8-main-scss.bundle.js
PPRO-css-generated-81-main-scss.bundle.js
PPRO-css-generated-83-main-scss.bundle.js
PPRO-css-generated-85-main-scss.bundle.js
PPRO-css-generated-87-main-scss.bundle.js
PPRO-css-generated-89-main-scss.bundle.js
PPRO-css-generated-91-main-scss.bundle.js
PPRO-css-generated-93-main-scss.bundle.js
PPRO-css-generated-95-main-scss.bundle.js
PPRO-css-generated-97-main-scss.bundle.js
PPRO-css-generated-99-main-scss.bundle.js
PowerPoint-css-darker-main-scss.bundle.js
PowerPoint-css-lighter-main-scss.bundle.js
SPRK-css-lighter-main-scss.bundle.js
Word-css-darker-main-scss.bundle.js
Word-css-lighter-main-scss.bundle.js
ColorExtractor.worker.js
GradientExtractor.worker.js
ShapeExtractor.worker.js
capture_main.js
package.json
index.html
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
main.js
manifest.json
purchaseTypekit.html
CreativeCloud_icon.svg
NewUserEmpty_dark.svg
NewUserEmpty_light.svg
icons.svg
wait_32.gif
manifest.json
crl-set
manifest.json
manifest.fingerprint
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
manifest.fingerprint
manifest.fingerprint
manifest.fingerprint
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
Adobe01.bmp
crWinLog_c7eebd30-0ae6-4fc5-a992-f693c9ab8f47_Creative Cloud Helper_6.10_6.10.0.253.tag
crWinLog_c7eebd30-0ae6-4fc5-a992-f693c9ab8f47_Creative Cloud UI Helper_6.10_6.10.0.253.tag
metadata.db
metadata.db
metadata.db-wal
metadata.db-mj0FA52A9A9
assets.db-wal
metadata.db
metadata.db-mj1D15D9912
metadata.db-mj55EB2A9FE
metadata.db-mjAD70F797E
metadata.db-mjC2AEF3964
metadata.db-mjCF6F1290B
metadata.db-mjD31F989AD
metadata.db-wal
.adobefeatureflagnotification
.adobestatusnotification
150875c486ee261aa65a004d5128b674-index.json
ACSLEng.cfg
ACSLEng.cfg
Adobe App Info (Q0NYUHJvY2VzczF7fTIwMTgwNzIwMDE)
Adobe App Info (Q29yZVN5bmMxe30yMDE4MDcyMDAx)
Adobe App Info (Q3JlYXRpdmVDbG91ZDJ7fTIwMTgwNzIwMDE)
Adobe App Info (Q3JlYXRpdmVDbG91ZDJ7fTIwMTgwNzIwMDE)
Adobe App Info (Q3JlYXRpdmVDbG91ZDJ7fTIwMTgwNzIwMDE)
Adobe App Info (Q3JlYXRpdmVDbG91ZEluc3RhbGxlcjF7fTIwMTgwNzIwMDE)
Adobe User Info
com.adobe.acc.container.default.prefs
com.adobe.acc.container.default.prefs
com.adobe.acc.onboarding.491081376A8456340A495F95.prefs
com.adobe.acc.onboarding.491081376A8456340A495F95.prefs
com.adobe.acc.onboarding.491081376A8456340A495F95.prefs
com.adobe.acc.onboarding.491081376A8456340A495F95.prefs
com.adobe.acc.onboarding.491081376A8456340A495F95.prefs
icons
settings.dat
settings.dat
f_000001
f_000004
the-real-index
the-real-index~RFe5b4bfa.TMP
index
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity~RFe5b0740.TMP
Preferences
Preferences~RFe5ab680.TMP
MANIFEST-000001
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5a17cf.TMP
keys.json
LocalPrefs.json
LocalPrefs.json~RFe5d227f.TMP
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_00006a
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt~RFe59f1c9.TMP
the-real-index
the-real-index
the-real-index
a3567d60-bcfa-4287-bf51-b860d6312c7f.tmp
Local State
Local State
Local State
Local State
Local State
Local State
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
AppCache134315361064491699.txt
15a7950f-575f-446b-ad09-61fb4a344c90_temp.zip
8b065717-9f1f-409c-920c-cbeab737c0e2_temp.zip
ACC.log
ACC.log
ACC.log
ACC.log
DLM.log
DLM.log
CCX Process.log
config.ini
NGLClient_CCXProcess17.11.log
NGLClient_CCXProcess17.11.log
NGLClient_CoreSync17.8.10.1.log
NGLClient_CreativeCloud2.ngllogcontrolconfig
NGLClient_CreativeCloud26.10.0.252.3.log
NGLClient_CreativeCloud26.10.0.252.3.log
NGLClient_default.log
PDApp.log
RGI23BD.tmp
RGI23F0.tmp
TMP_2026081810122185341
IPC.pimx
SpColorSlider.bundle.js.LICENSE.txt
OneUp.pimx
oobelib.log
oobelib.log
oobelib.log
CCDInstaller.js
AdobePIM.dll
protocols.json
settings.dat
settings.dat
throttle_store.dat
f_00000d
the-real-index
the-real-index
Network Action Predictor
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5a78fa.TMP
Preferences
Preferences
Preferences
Preferences~RFe5a6d71.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5a17cf.TMP
index.css
index.html
map.json
map.json
map.json
CCXP-7.11.0-en_US-6d2a3747-d305-4031-a268-8e240cabfbf3.json
CCXP-7.11.0-en_US-6d2a3747-d305-4031-a268-8e240cabfbf3.json
map.json
map.json_f97151b6-6903-4936-a80e-f1bd1ac53639.json
map.json_e07bfeb3-aafe-45e8-8df3-d524597729c6.json
map.json_2557cc57-f6d9-44fb-91a2-728780a01956.json
map.json_9624d9c6-6c11-4ad3-89d7-53ccbbd8797e.json
map.json_5e249e22-3ea5-4bd5-b7b9-c09ecdcc2f08.json
map.json_178a7fbe-6ae9-4164-afca-58495425b5ea.json
desktop.ini
default.dic
CameraRoll.library-ms
Documents.library-ms
Documents.library-ms
Music.library-ms
Music.library-ms
Pictures.library-ms
Pictures.library-ms
SavedPictures.library-ms
Videos.library-ms
Videos.library-ms
desktop.ini
7e4dca80246863e3.customDestinations-ms
f01b4d95cf55d32a.customDestinations-ms
TranscodedWallpaper
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
1561eb71-5d2a-4e64-b4fb-c3c5330f05d9
2c7e82a5-7f8d-4735-8783-592c06097320
6e33f963-077b-4669-86a7-4303de6e480d
9839a2cf-e49d-42ab-9077-4038631ad734
bed20777-ba86-437b-a0e2-82a6ae78d1cf
f3ea73a9-c2de-4620-8b9b-fc413d66d56c
prefs-1.js
prefs.js
sessionCheckpoints.json
3870112724rsegmnoittet-es.sqlite
Bing.url
ConsentRecord
ConsentRecord
e5c3d6f.msi
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
license.rtf
thm.wxl
VC_redist.x64.exe
license.rtf
thm.wxl
thm.xml
logo.png
wixstdba.dll
vcredist_x86.exe
wixstdba.dll
main.jsx
brush.jsx
color.jsx
text.jsx
color.jsx
util.jsx
main.jsx
brush.jsx
color.jsx
constants.jsx
gradient.jsx
layerstyle.jsx
main.jsx
text.jsx
main.jsx
ccd.html
core.jsx
json2.jsx
shims.jsx
DropGraphicFiles.svg
MissingLinkedElement_Dark.svg
MissingLinkedElement_Light.svg
ScrollDownArrow_darker.svg
ScrollDownArrow_light.svg
ScrollUpArrow_darker.svg
ScrollUpArrow_light.svg
aac_filetype_256.svg
aac_filetype_64.svg
aif_filetype_256.svg
aif_filetype_64.svg
aiff_filetype_256.svg
aiff_filetype_64.svg
captureCoachMark.png
checkerboard.png
m4a_filetype_256.svg
m4a_filetype_64.svg
mp2_filetype_256.svg
mp2_filetype_64.svg
mp3_filetype_256.svg
mp3_filetype_64.svg
scroll_triangle_down_dark.svg
scroll_triangle_down_light.svg
scroll_triangle_left_dark.svg
scroll_triangle_left_light.svg
scroll_triangle_right_dark.svg
scroll_triangle_right_light.svg
scroll_triangle_up_dark.svg
scroll_triangle_up_light.svg
unlock_coachmark.png
wav_filetype_256.svg
wav_filetype_64.svg
S_Illu_HelpxArticlesOnAiHomeScreen_5.jpg
LICENSE
LICENSE
cc_app32.png
index.js
osx.js
osxCerts.js
proxyConnection.js
tunnel.js
utils.js
win.js
VulcanControlAdapter.js
abort-controller.js
package.json
polyfill.js
.eslintignore
LICENSE
README.md
index.js
package.json
LICENSE
callBound.js
LICENSE
README.md
license
LICENSE
LICENSE
LICENSE
.eslintrc
.nycrc
.eslintrc
LICENSE
event-target-shim.js
package.json
CHANGELOG.md
LICENSE
README.md
index.js
package.json
test.js
license
index.js
index.js
jsonfile.js
index.js
make-dir.js
utils.js
index.js
LICENSE
index.js
index.js
README.md
LICENSE
README.md
clone.js
graceful-fs.js
legacy-streams.js
package.json
polyfills.js
LICENSE
README.md
index.js
.eslintrc
.nycrc
LICENSE
LICENSE
README.md
inherits.js
inherits_browser.js
package.json
LICENSE
.editorconfig
index.js
package.json
readme.md
LICENSE
CHANGELOG.md
LICENSE
README.md
index.js
package.json
utils.js
index.d.ts
index.d.ts.map
index.min.js.map
package.json
CHANGELOG.md
Mime.js
README.md
cli.js
index.js
lite.js
package.json
other.js
standard.js
find-made.d.ts
index.d.ts
mkdirp-manual.d.ts
mkdirp-native.d.ts
opts-arg.d.ts
path-arg.d.ts
use-native.d.ts
common.js
ntlm.js
smbhash.js
package.json
README.md
once.js
package.json
index.js
license
package.json
readme.md
xdg-open
LICENSE
README.md
index.js
package.json
test.js
license
index.js
license.md
package.json
readme.md
README.md
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
Makefile
README.md
component.json
package.json
test.js
package.json
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
index.js
package.json
range.bnf
LICENSE
README.md
index.d.ts
package.json
LICENSE
History.md
LICENSE
README.md
browser.js
node.js
package.json
CONTRIBUTING.md
LICENSE.md
uuid
native.js
rng.js
stringify.js
v1.js
v35.js
v4.js
version.js
index.js
nil.js
regex.js
stringify.js
v1.js
v35.js
v4.js
validate.js
version.js
md5.js
rng.js
sha1.js
md5.js
rng.js
sha1.js
uuid-bin.js
wrapper.mjs
package.json
README.md
package.json
wrappy.js
LICENSE
bom.js
builder.js
defaults.js
parser.js
processors.js
xml2js.js
CHANGELOG.md
README.md
appveyor.yml
Derivation.js
DocumentPosition.js
NodeType.js
OperationType.js
Utility.js
WriterState.js
XMLAttribute.js
XMLCData.js
XMLCharacterData.js
XMLComment.js
XMLDOMConfiguration.js
XMLDOMErrorHandler.js
XMLDOMImplementation.js
XMLDOMStringList.js
XMLDTDAttList.js
XMLDTDElement.js
XMLDTDEntity.js
XMLDTDNotation.js
XMLDeclaration.js
XMLDocType.js
XMLDocument.js
XMLDocumentCB.js
XMLDocumentFragment.js
XMLDummy.js
XMLElement.js
XMLNamedNodeMap.js
XMLNode.js
XMLNodeFilter.js
XMLNodeList.js
XMLProcessingInstruction.js
XMLRaw.js
XMLStreamWriter.js
XMLStringWriter.js
XMLStringifier.js
XMLText.js
XMLTypeInfo.js
XMLUserDataHandler.js
XMLWriterBase.js
index.js
package.json
index.d.ts
README.md
index.js
package.json
main.jsx
core.jsx
main.jsx
text.jsx
util.jsx
manifest.xml
capture.html
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
messages.properties
CornucopiaCore.wasm
GradientCaptureCore.wasm
VectorizeCore.wasm
capture_merchandising.png
capture_sample.png
messages.properties
messages.properties
GroupOnboardingBackground_CCD.png
GroupOnboardingGraphic_CCD.png
coachmark.png
ScrollDownArrow_dark.svg
ScrollUpArrow_dark.svg
SP_PresetClipboard.png
messages.properties
messages.properties
mimetype
CCX_Start_DefaultThumb_other.png
messages.properties
desktop.ini
memory/404-6258-0x00007FFE05C40000-0x00007FFE05C4C000-memory.dmp
memory/404-6257-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/404-6259-0x00007FFDF7470000-0x00007FFDF748B000-memory.dmp
memory/1068-1139-0x00007FFE14080000-0x00007FFE14081000-memory.dmp
memory/1740-3987-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3998-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-4000-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3999-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3997-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3996-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3995-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3994-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3986-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1740-3988-0x000001E3F1730000-0x000001E3F1731000-memory.dmp
memory/1752-31-0x000002C000000000-0x000002C000001000-memory.dmp
memory/3336-5589-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-1949-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-5190-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-8491-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-9678-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-3320-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-1793-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-13329-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-11560-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-1076-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-10721-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-1687-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-1620-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3336-1541-0x0000000000190000-0x0000000000C3F000-memory.dmp
memory/3460-6095-0x0000000000840000-0x00000000008B7000-memory.dmp
memory/4756-6346-0x0000000000420000-0x0000000000497000-memory.dmp
memory/4872-1326-0x00007FFE14080000-0x00007FFE14081000-memory.dmp
memory/5004-6263-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/5004-6264-0x00007FFE05C40000-0x00007FFE05C4C000-memory.dmp
memory/5004-6265-0x00007FFDF7470000-0x00007FFDF748B000-memory.dmp
memory/5112-6260-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/5112-6262-0x00007FFDF7470000-0x00007FFDF748B000-memory.dmp
memory/5112-6261-0x00007FFE05C40000-0x00007FFE05C4C000-memory.dmp
memory/5476-1281-0x00007FFE13AD0000-0x00007FFE13AD1000-memory.dmp
memory/5476-1282-0x00007FFE14190000-0x00007FFE14191000-memory.dmp
memory/6732-5599-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5608-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5598-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5604-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5605-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5606-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-6358-0x0000000071BE0000-0x0000000071BF5000-memory.dmp
memory/6732-6359-0x0000000071B70000-0x0000000071BDD000-memory.dmp
memory/6732-5607-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5600-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6732-5609-0x0000000007B30000-0x0000000007B31000-memory.dmp
memory/6784-6344-0x00007FFDF7470000-0x00007FFDF748B000-memory.dmp
memory/6784-6343-0x00007FFE05C40000-0x00007FFE05C4C000-memory.dmp
memory/6784-6342-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/6812-6349-0x0000000000420000-0x0000000000497000-memory.dmp
memory/6984-6217-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/6984-6218-0x00007FFE05C40000-0x00007FFE05C4C000-memory.dmp
memory/6984-6219-0x00007FFDF7470000-0x00007FFDF748B000-memory.dmp
memory/6984-7205-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/7160-6348-0x0000000000420000-0x0000000000497000-memory.dmp
memory/7264-6092-0x0000000000840000-0x00000000008B7000-memory.dmp
memory/7804-6104-0x0000000000840000-0x00000000008B7000-memory.dmp
memory/7944-6103-0x0000000000840000-0x00000000008B7000-memory.dmp
memory/7984-6360-0x00007FFDF2810000-0x00007FFDF289E000-memory.dmp
memory/7984-6362-0x00007FFDF7470000-0x00007FFDF748B000-memory.dmp
memory/7984-6361-0x00007FFE05C40000-0x00007FFE05C4C000-memory.dmp
memory/7988-6094-0x0000000000840000-0x00000000008B7000-memory.dmp